Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a legitimate KeyAPI YouTube analysis helper, with important local token and cache behavior users should understand.
Install only if you trust KeyAPI with the video, comment, search, and trend queries you submit. Prefer setting KEYAPI_TOKEN in your environment instead of typing it into the prompt, because the prompt saves it to a plaintext .env file. Treat .keyapi-cache as a local record of API responses, and note that --no-cache skips cache lookup but the script still writes fresh results unless you use a disposable cache directory or remove the cache afterward. Always pass --platform youtube and use the documented YouTube tool names.
Execute tool calls and persist responses to the local cache. **Calling a tool:** ```bash node scripts/run.js --platform youtube --tool <tool_name> \
// ── MCP client ────────────────────────────────────────────────────────────────
/** Prompt for KEYAPI_TOKEN interactively and persist it to .env */
async function promptToken() {
if (!process.stdin.isTTY) {
throw new Error(reject(new Error("No token entered. Set KEYAPI_TOKEN and try again."));
return;
}
const envPath = join(ROOT, ".env");
writeFileSync(envPath, `KEYAPI_TOKEN=${token}\n`, "utf8");
log(`[token] Saved to ${envPath} — future runs will load it automatically`);
process.env.KEYAPI_TOKEN = token;No suspicious patterns detected.