YouTube SkillForge

Turn YouTube videos into structured, reusable skill files that make any AI agent smarter. Forge, compound, and recall creator-attributed knowledge.

Security Scan

The skill's declared behavior, required tools, and runtime instructions are internally consistent with its purpose of turning YouTube videos into local skill files, but the package source is undocumented and you should verify the npm package before installing.

Purpose & Capability

The skill converts YouTube videos into skill files; requiring yt-dlp and offering a node CLI is appropriate and proportional. The listed binaries and install steps align with the stated purpose.

Instruction Scope

SKILL.md stays mostly within scope: it documents writing only to ~/.skillforge (with a consent prompt), rebuilding a local SQLite index, and running an MCP stdio server. It also notes that it uses whatever LLM the host agent already has configured (e.g. ANTHROPIC_API_KEY) — this is plausible but worth noting because the skill will rely on the agent's provider credentials even though it doesn't request them directly.

Install Mechanism

Install spec uses an npm package (youtube-skillforge) and Homebrew formula for yt-dlp, both reasonable. However the registry metadata lists no homepage/source URL and the skill's registry owner is opaque; you should verify the npm package publisher and any postinstall scripts before installing.

Credentials

The skill declares no required env vars and doesn't ask for credentials. It will, however, invoke the host agent's configured LLM (which may require provider keys already present in the agent environment). That use is consistent with the described behavior but users should be aware their agent's provider keys may be used to synthesize transcripts.

Persistence & Privilege

always:false (not force-included) and the skill writes only to its own folder (~/.skillforge/) per the docs. It runs as a subprocess over stdio and does not require network-facing servers. These privileges are reasonable for the stated functionality.

Assessment

The skill appears coherent for turning YouTube content into local skill files, but before you install: 1) Verify the npm package publisher and view the package source (check for unexpected postinstall scripts or network calls). 2) Confirm you trust the package owner — registry metadata has no homepage/source URL. 3) Expect the CLI to create ~/.skillforge/ (it says it will prompt for consent) — inspect that directory and its files after first run. 4) Understand that transcript synthesis uses whatever LLM keys your agent already has (e.g. ANTHROPIC_API_KEY); the skill doesn't ask for new credentials but will rely on existing agent-provider credentials. 5) Prefer installing yt-dlp from a trusted package manager (Homebrew) and consider running the CLI in a sandboxed environment initially. If you want higher assurance, request the skill's source code or an official homepage before adding it to production agents.

SkillForge

Turn YouTube videos into structured, reusable skill files that make any AI agent smarter.

Credential Requirements

SkillForge requires no API keys or credentials of its own. It produces structured skill files from YouTube transcripts; transcript synthesis uses whatever LLM the user's OpenClaw agent is already configured with (e.g. Claude via ANTHROPIC_API_KEY). SkillForge never stores, proxies, or manages provider credentials.

File System Behavior

SkillForge writes to ~/.skillforge/ on first use. Before creating this directory, the CLI prompts for explicit user consent.

Contents of ~/.skillforge/:

• library/ — Skill files organized by creator slug and topic (e.g. library/alex-hormozi/lead-magnets/SKILL.md)
• config.json — User preferences (trusted creators list, consent flag)
• proposals/ — Saved scan proposals for deferred builds
• skills.db — SQLite full-text search index used by the MCP server and recall command

SkillForge does not write outside ~/.skillforge/ unless the user provides an explicit --output path.

MCP Server Behavior

The skillforge serve command starts an MCP server using stdio transport (StdioServerTransport from @modelcontextprotocol/sdk). It communicates via stdin/stdout as a subprocess — there is no HTTP server, no port binding, and no network exposure. The host agent (e.g. Claude Desktop) launches SkillForge as a child process and exchanges JSON-RPC messages over the stdio pipe.

The server exposes two tools:

• skillforge_recall — Full-text search across indexed skills
• skillforge_list — List all skills grouped by creator

On startup, the server rebuilds the SQLite index at ~/.skillforge/skills.db from skill files on disk.

Commands

Command	Writes to ~/.skillforge/	Description
watch <url>	Yes	Build a skill from a single YouTube video
build [url]	Yes	Build from URL, channel, topic, or proposal
scan <url>	Yes	Score videos by relevance and save a proposal
serve	Yes	Start the MCP server (stdio transport)
forge	Yes	Alias for build
trust add/remove	Yes	Manage trusted creators
recall	No	Search the skill library by intent
list	No	List all saved skills
check	No	Check if a skill exists for an intent
suggest	No	Search YouTube for channels by topic
share	No	Export a skill with attribution
check-auth	No	Verify provider authentication