YouTube API CLI

• Analyzed: May 12, 2026, 3:06 AM
• Findings: 1
• Version: 1.0.2
• Hash: d1b6bc4618613684d973c7b6682eb4b34b6e028cf475e5ad2388d5368b36c664
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle for `yt-api-cli` appears benign. The `SKILL.md` provides standard instructions for installing and configuring a YouTube Data API CLI tool from a public GitHub repository (github.com/nerveband/youtube-api-cli). It requires YouTube API credentials as environment variables, which is expected for an API client. Installation involves `go install` or `curl` to download a binary, followed by `chmod +x` and `sudo mv` to `/usr/local/bin`, all standard procedures for CLI tool setup. There are no signs of data exfiltration, malicious execution patterns (e.g., `curl|bash`), persistence mechanisms, obfuscation, or prompt injection attempts against the agent that would lead to unauthorized actions or deviation from the stated purpose.