YouTube API CLI
ReviewAudited by ClawScan on May 10, 2026.
Overview
This is a coherent YouTube CLI skill, but it warrants review because it can give an agent broad ability to publish or change YouTube account content through an unreviewed external tool.
Install only if you trust the referenced GitHub CLI. Before letting an agent use it, pin and verify the installed version, use least-privilege and revocable Google credentials, protect the local token file, and require explicit approval for uploads, channel updates, playlist changes, or any other account-mutating command.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If an agent invokes the wrong command, it could publish a video or change YouTube account content in a way the user did not intend.
These documented commands can publish public content and modify channel state. The skill presents them for CLI/automation use without a mandatory confirmation, dry-run, or safe-default workflow.
yt-api upload video ./video.mp4 ... --privacy public ... yt-api update channel --id UCxxx --description "New description"
Require explicit user approval for uploads and account mutations, use --dry-run first, prefer private visibility by default, and limit OAuth scopes where possible.
Anyone with access to the configured secrets or token file may be able to act through the connected YouTube account, depending on granted permissions.
The tool uses OAuth or service-account credentials and persists OAuth tokens. This is expected for YouTube account management, but it is sensitive account authority.
YT_API_CLIENT_SECRET | OAuth client secret ... YT_API_CREDENTIALS | Path to service account JSON ... OAuth tokens stored in `~/.yt-api/tokens.json` (0600 permissions)
Use a dedicated Google Cloud OAuth client, grant the minimum needed scopes, protect ~/.yt-api, and revoke tokens when the skill is no longer needed.
The installed executable will be trusted with YouTube credentials and account actions, so a compromised or changed upstream release could affect the account.
Installation pulls the latest external code or binary from GitHub, and the reviewed skill artifacts do not include the CLI source, a pinned version, or checksum verification.
go install github.com/nerveband/youtube-api-cli/cmd/yt-api@latest ... curl -L -o yt-api https://github.com/nerveband/youtube-api-cli/releases/latest/download/yt-api-darwin-arm64
Inspect the GitHub project before installing, pin a specific release or commit, and verify checksums or signatures when available.