Gemini Yt Video Transcript

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

The video URL and related request data are processed by external services as part of generating the transcript.

Why it was flagged

The user-provided video URL is sent to Google Gemini for processing, and the script also performs a YouTube title lookup; this is expected for the transcript function.

Skill content

API_ENDPOINT = f"https://generativelanguage.googleapis.com/v1beta/models/{GEMINI_MODEL}:generateContent" ... {"file_data": {"file_uri": url}}

Recommendation

Use this skill only for videos you are comfortable processing through Google Gemini/YouTube, and review the transcript before sharing it.

Note

ASI03: Identity and Privilege Abuse

What this means

Gemini API usage may consume the user's quota or incur costs depending on the configured Google account.

Why it was flagged

The script uses the user's Gemini API key to authenticate to Google's Generative Language API; this is purpose-aligned and disclosed, but the key may carry quota or billing authority.

Skill content

api_key = os.environ.get("GEMINI_API_KEY") ... "x-goog-api-key": api_key

Recommendation

Use a dedicated or limited Gemini API key where possible, monitor usage, and rotate the key if it is exposed.