Youtube → Pocket Casts

Download YouTube videos and upload them to Pocket Casts Files for offline viewing. For personal use with content you own or have rights to.

Security Scan

The skill's code and instructions are consistent with its stated purpose (downloading YouTube videos you own/are permitted to download and uploading them to Pocket Casts Files); required credentials and behavior align with that purpose and there is no unexplained access or hidden network endpoint.

Purpose & Capability

Name/description (YouTube -> Pocket Casts) matches what the files do: the script downloads a video (yt-dlp) and uploads it to Pocket Casts via its API using a user-provided refresh token and YouTube cookies. No unrelated services, binaries, or credentials are requested.

Instruction Scope

SKILL.md and the script keep to the stated task. The instructions explicitly require a Pocket Casts refresh token and YouTube cookies and explain where to store them; the script reads only those files, downloads the video to /tmp, requests a presigned upload URL from api.pocketcasts.com, PUTs the file, and deletes the local file. There is no hidden data collection or extra file-system access beyond the credentials directory and /tmp.

Install Mechanism

There is no install spec (instruction-only skill) and the code is local. The only potentially risky instruction is an optional recommendation to install deno via a remote install script (curl https://deno.land/install.sh | sh). That is standard but involves running an external install script; it's optional and not required for the core flow. The script also expects yt-dlp to be runnable via 'uvx yt-dlp' (uvx is referenced in prerequisites); ensure yt-dlp is installed and callable on your system.

Credentials

The skill requests no platform-level secrets. It asks the user to provide a Pocket Casts refresh token and YouTube cookies — these are directly needed for the described flow. The skill introduces one override env var (CLAWDBOT_CREDENTIALS) which is reasonable and documented. No unrelated credentials or broad environment access are requested.

Persistence & Privilege

The skill does not request always:true and does not alter other skills or system-wide settings. It stores user-provided credential files under a user-owned path (~/.clawdbot/credentials/pocket-casts) and does not persist beyond that. The agent can invoke autonomously (platform default), which is expected for a user-invocable skill.

Assessment

This skill appears to do what it claims, but take these precautions before installing or using it: - Only provide a Pocket Casts refresh token and YouTube cookies you control; these contain session-level access — store them with strict permissions (the guide already sets 600/700). If leaked, they could be abused. - The SKILL.md recommends installing deno by piping a remote script to sh; avoid running remote install scripts unless you trust the source — prefer package manager installs if available. - Confirm you have the right to download and upload content; downloading YouTube content may violate YouTube's ToS and/or copyright law depending on the content and your jurisdiction. - Verify yt-dlp is installed and callable (script uses 'uvx yt-dlp'); running the script in an isolated or disposable environment (or reviewing the uploaded file contents) reduces risk. - Review the included scripts (scripts/upload.sh) yourself before running and keep credentials offline until ready. If you want higher assurance, run a dry run on non-sensitive content first.

Pocket Casts YouTube Uploader

Download YouTube videos and upload them to Pocket Casts Files for offline viewing.

Usage

~/skills/pocket-casts/scripts/upload.sh "YOUTUBE_URL"

Or with a custom title:

~/skills/pocket-casts/scripts/upload.sh "YOUTUBE_URL" "Custom Title"

Prerequisites

Required

• yt-dlp - YouTube downloader (via uv: uvx yt-dlp)
• ffmpeg - Video processing (apt install ffmpeg)
• curl - HTTP requests (usually pre-installed)
• jq - JSON parsing (apt install jq)

Recommended

• deno - JavaScript runtime for yt-dlp challenges:

  curl -fsSL https://deno.land/install.sh | sh
  

  Add to PATH: export PATH="$HOME/.deno/bin:$PATH"

Setup

1. Create credentials directory:

   mkdir -p ~/.clawdbot/credentials/pocket-casts
   chmod 700 ~/.clawdbot/credentials/pocket-casts
   

2. Add Pocket Casts refresh token:

   Get your refresh token from browser dev tools while logged into pocketcasts.com, then:

   cat > ~/.clawdbot/credentials/pocket-casts/config.json << 'EOF'
   {
     "refreshToken": "YOUR_REFRESH_TOKEN_HERE"
   }
   EOF
   chmod 600 ~/.clawdbot/credentials/pocket-casts/config.json
   

   The refresh token lasts ~1 year. Access tokens are fetched automatically.

3. Add YouTube cookies (required for most videos):

   YouTube's bot detection requires cookies from a logged-in browser session.

   • Install "Get cookies.txt LOCALLY" browser extension (or similar)
   • Go to youtube.com while logged in
   • Export cookies via the extension
   • Save to ~/.clawdbot/credentials/pocket-casts/cookies.txt

   chmod 600 ~/.clawdbot/credentials/pocket-casts/cookies.txt
   

How It Works

1. Downloads video via yt-dlp --remux-video mp4
2. Refreshes Pocket Casts access token using stored refresh token
3. Requests presigned upload URL from Pocket Casts API
4. PUTs file to S3 via presigned URL
5. Deletes local video file

Environment Variables

• CLAWDBOT_CREDENTIALS - Override credentials directory (default: ~/.clawdbot/credentials)

Notes

• Files appear in the Pocket Casts "Files" tab
• Videos play natively in the app (iOS/Android/Web)
• Max file size depends on your Pocket Casts subscription (~2GB for Plus)
• Cookies may need refreshing if YouTube blocks requests

⚠️ Legal Disclaimer

This skill is provided for personal, fair-use purposes only.

• YouTube Terms of Service prohibit downloading videos except via official means. Downloading may violate YouTube's ToS depending on your jurisdiction and intended use.
• Pocket Casts Terms require that you own or have the rights to any media you upload to your Files library.
• Copyright law varies by country. Downloading and storing copyrighted content without permission may be illegal in your jurisdiction.

By using this skill, you accept full responsibility for ensuring your use complies with all applicable terms of service and laws. The authors disclaim any liability for misuse.

Recommended uses: Personal recordings, Creative Commons content, videos you created, or content where the creator has explicitly permitted downloading.