YouTube API

AdvisoryAudited by Static analysis on May 9, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

An agent using this skill can make authenticated AGNTDATA YouTube API requests, which may expose usage metadata and consume paid credits.

Why it was flagged

The skill requires a third-party API key to authenticate requests. This is expected for the stated API-integration purpose, but it is still sensitive account authority.

Skill content
The API key should be available as the `AGNTDATA_API_KEY` environment variable. Every request must include it as a Bearer token
Recommendation

Only set AGNTDATA_API_KEY if you trust the AGNTDATA service, use a rotatable key where possible, and monitor API usage or billing.

What this means

Search terms or other request parameters provided to the skill may be visible to AGNTDATA.

Why it was flagged

The skill sends API requests to an external AGNTDATA service. This is disclosed and purpose-aligned, but user queries, video IDs, channel IDs, and use-case details may be transmitted to that provider.

Skill content
Base URL

```
https://api.agntdata.dev/v1/data/youtube
```
Recommendation

Avoid sending sensitive or private query content unless you are comfortable with AGNTDATA receiving it, and review the provider's privacy and retention terms.

What this means

Installing the optional plugin could add executable code and permissions beyond this instruction-only skill.

Why it was flagged

The skill recommends installing a separate plugin package that is not included in the provided file manifest, so its code and permissions were not evaluated in these artifacts.

Skill content
For the best experience, install the OpenClaw plugin for YouTube API instead of this skill.

```bash
openclaw plugins install @agntdata/openclaw-youtube
```
Recommendation

If you choose the plugin path, review the plugin package source, publisher, version, and requested permissions before installing.