Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed YouTube/TranscriptAPI helper with expected API-key use and no hidden code or destructive behavior.
Before installing, confirm you are comfortable giving TranscriptAPI.com your API key and YouTube queries, and avoid saving the key to local config on shared machines unless you accept plaintext config and backup exposure.
The manifest description says to use the skill whenever you need 'comprehensive YouTube access' or 'the full suite of YouTube data endpoints,' which is very broad and lacks clear activation boundaries. It does not provide specific trigger phrases, scope limits, or exclusion examples, increasing the risk of unintended invocation in many ordinary YouTube-related contexts.
The text 'Everything in one skill' is an ambiguous capability claim rather than a specific activation guideline. Because it lacks constraints or negative examples, an agent could over-select this skill for general YouTube-related requests beyond its intended API-backed operations.
The skill explicitly instructs persisting an API key into a local config file under ~/.openclaw/openclaw.json, creating longer-lived credential storage outside the immediate session. Persistent storage increases exposure if the host is shared, backups are accessible, file permissions are weak, or other tools later read and misuse the saved secret.
You MUST have a `$TRANSCRIPT_API_KEY` environment variable set.
If you don't have tell the user to create a free account at transcriptapi.com: [transcriptapi.com/signup](https://transcriptapi.com/signup) → Dashboard → API Keys.
If you have the key, See **File Writes** below for details. Existing file is backed up before modification.
No suspicious patterns detected.