Back to skill
Skillv1.0.0
ClawScan security
YouTube Uploader · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 22, 2026, 7:31 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, instructions, and requirements are consistent with a YouTube uploader: it uses OAuth, stores user credentials locally, and installs the Google API client into a local venv — nothing in the package indicates extraneous or hidden data exfiltration.
- Guidance
- This skill appears to do exactly what it says: perform OAuth2 with Google and upload videos via the YouTube Data API. Before installing/running, consider: 1) You must create/download the Google client_secret.json yourself — verify it comes from your Google Cloud project. 2) The script will create ~/.openclaw/youtube/, save your client_secret.json and OAuth tokens there, and create a virtualenv and pip-install packages from PyPI; review the script if you want to audit behavior first. 3) If you ever want to revoke access, remove the saved channels.json and revoke the OAuth refresh token in your Google account. 4) If you are uncomfortable with automatic pip installs, run the script inside a controlled virtual environment you create yourself. Overall the package is coherent with its stated purpose and contains no obvious exfiltration or unrelated privileges.
Review Dimensions
- Purpose & Capability
- okName/description (upload videos & thumbnails) match the included script and SKILL.md. Required binary is python3 and the script uses the YouTube Data API via OAuth2 — these are appropriate and expected.
- Instruction Scope
- okSKILL.md instructs the user to run the script's auth/upload/thumbnail commands and to provide a Google OAuth client_secret.json. The runtime instructions operate only on local files (video, thumbnail, client_secret.json) and the Google APIs; they do not request unrelated system files or external endpoints beyond Google and a localhost redirect for OAuth.
- Install Mechanism
- noteNo install spec in registry, but the script bootstraps a per-user virtualenv at ~/.openclaw/youtube/.venv and installs packages from PyPI (pip). This is reasonable for a Python tool but does create writable files and executes pip installs on first run — users should be aware of that behavior.
- Credentials
- okThe skill does not request environment variables or unrelated credentials. It requires the user-provided Google client_secret.json and stores OAuth tokens locally; no other secrets are requested or transmitted by the skill.
- Persistence & Privilege
- noteThe script creates a per-user directory (~/.openclaw/youtube), writes client_secret.json and channels.json (with owner-only permissions), and creates a virtualenv. It does not set always:true, does not modify other skills, and does not require elevated privileges, but it does persist tokens and installed packages in the user's home directory.