Youtube Music Player
v0.2.0Operate YouTube Music via natural language. Search songs, artists, albums, playlists, lyrics, charts, recommendations, and control playback. Browse personal...
⭐ 0· 103·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name and description match the delivered files and behavior: helper.py provides search/library/playlist/account operations via ytmusicapi, and player.py + player_daemon.py use Playwright for playback. Requiring a .ytmusic/auth.json config and the uv runner is coherent with the stated functionality.
Instruction Scope
SKILL.md and helper.py explicitly instruct the agent to ask the user for either a raw Cookie header string or a cookies JSON file path and then run local auth setup, which is necessary for authenticated YouTube Music operations. This is narrow and scoped to YT Music auth, but it explicitly asks for sensitive secrets (browser cookies) and instructs the agent to read a file path supplied by the user. That behavior is expected for this use-case but should be treated as sensitive.
Install Mechanism
No external install or download steps are embedded in the skill bundle; the skill is instruction/code-only and relies on the uv runner to pull runtime packages (ytmusicapi, playwright) on demand. No arbitrary URL downloads or archive extraction were found in the provided files.
Credentials
The skill requests no environment variables but requires a local config path (.ytmusic/auth.json) and will persist cookies and a Playwright profile under ./ .ytmusic. Requesting YouTube cookies (including SAPISID) is proportionate to the stated need for authenticated actions, but those are highly sensitive credentials — storing and transmitting them (even locally) increases risk. The helper can import any file path the user provides, so if a user supplies a path to an unrelated sensitive file the agent would attempt to read it.
Persistence & Privilege
The skill creates and persists state in ./ .ytmusic (auth.json, player-daemon.json, playwright-profile) and launches a local daemon (bound to 127.0.0.1) and a persistent browser profile. always:false and no cross-skill config modification are present, so privileges are reasonable, but the persistent browser profile will retain logged-in state and cookies until removed.
Assessment
This skill is internally consistent for controlling YouTube Music, but it requires you to provide browser cookies (a raw Cookie header or an exported cookies JSON) so it can perform authenticated actions. Cookies are very sensitive — anyone with them can act as you on music.youtube.com. Only provide cookies if you trust the skill and the environment running it. Safer options: (1) use a throwaway Google account for this skill, (2) run the skill only on a local machine you control (not in a shared/cloud agent), and (3) after use, remove the saved auth files (.ytmusic/auth.json and ./ .ytmusic/playwright-profile) and revoke the session from your Google account if possible. If you must provide a cookies JSON, restrict it to cookies for music.youtube.com and don't supply paths to unrelated system files. Finally, review the skill source (scripts/helper.py and player_daemon.py) yourself or run it in an isolated environment if you have doubts.Like a lobster shell, security has layers — review code before you run it.
latestvk976ynhem6q0ycsamxky0g8vz583grdf
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binsuv
Config.ytmusic/auth.json