YouTube Transcript

Fetch and download YouTube video transcripts with timestamps and multi-language support by providing the video URL.

Security Scan

The skill claims to fetch YouTube transcripts but the code only extracts a video ID and returns a placeholder; the SKILL.md embeds a plaintext API key and pricing with no explanation of who runs the paid service, which is inconsistent and risky.

Purpose & Capability

Name and description promise fetching/downloading transcripts with timestamps and multi-language support, but handler.py does not fetch transcripts — it only extracts a video ID and returns a demo message instructing to use an external library. The described capability is not implemented, and the SKILL.md's integration/payout details (API key, price) are not reflected in code.

Instruction Scope

SKILL.md advertises features and gives example outputs but provides no concrete runtime instructions or endpoints to call; it embeds a plaintext API key and pricing info, which suggests the agent might make network calls to a paid service, yet the code never does so. The instructions are vague and grant broad discretion without visible safeguards.

Install Mechanism

No install spec (instruction-only plus a small handler) — nothing is downloaded or installed by the skill itself, which is the lowest-risk install model.

Credentials

The package declares no required env vars, but SKILL.md contains a hard-coded API key that looks like a secret and a per-call price. Embedding such credentials in documentation is disproportionate and suspicious: it's unclear who owns the key, what service it gives access to, and whether using it could incur charges or leak the secret.

Persistence & Privilege

Skill does not request persistent privileges (always is false) and does not modify system or other skills. Normal autonomous invocation applies but doesn't by itself raise new concerns here.

What to consider before installing

Do not install this skill without clarification. It currently does not implement the advertised transcript-fetching behavior — it only parses a YouTube ID and returns a placeholder. SKILL.md includes a plaintext API key and a per-call price; you should treat that as a leaked credential until the author explains what service owns the key and who will be billed. Ask the publisher for: (1) source repository or homepage and author identity, (2) an explanation of the API key and billing, (3) actual code that performs transcript retrieval (including which external endpoint is called), and (4) a version that reads any secret (API key) from a required environment variable rather than embedding it in SKILL.md. If you cannot get these answers, avoid enabling the skill to prevent accidental use of an unknown paid service or leaking/using the embedded key.

Get transcript/subtitles from YouTube videos.

Features

• Auto-detect YouTube video URL
• Fetch available transcripts
• Support multiple languages
• Return timestamps

Price

• 0.001 USDT per transcript

Usage

"Get transcript of https://youtube.com/watch?v=..."
"Show video subtitles"
"Download YouTube captions"

Example Response

{
  "video_id": "dQw4w9WgXcQ",
  "title": "Video Title",
  "transcript": [
    {"time": "0:00", "text": "First line of transcript"},
    {"time": "0:05", "text": "Second line..."}
  ],
  "languages": ["en", "es", "zh"]
}

Integration

• API Key: sk_93c5ff38cc3e6112623d361fffcc5d1eb1b5844eac9c40043b57c0e08f91430e
• Price: 0.001 USDT per call