Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Youtube Music

v3.0.0

Control YouTube Music with natural language. Play, pause, skip, search, manage playlists, and queue tracks. Full playback control via browser automation.

0· 363·0 current·0 all-time
byom yarewara@oki3505f·duplicate of @oki3505f/youtube-music
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (YouTube Music control via browser automation) lines up with the code and SKILL.md: scripts open music.youtube.com, perform searches, and call the OpenClaw browser CLI. Minor inconsistency: SKILL metadata and package.json declare a required env var YOUTUBE_MUSIC_BROWSER_PROFILE, but the main v3 scripts default to the literal profile 'openclaw' and do not actually read that env var, so the declared requirement isn't used by the shipped scripts.
Instruction Scope
SKILL.md and scripts restrict actions to starting/checking the OpenClaw browser and opening YouTube Music search/watch URLs. The code does not attempt to read unrelated system files, request unrelated credentials, or POST data to external personal servers — it controls playback by opening search/watch URLs and relying on YouTube auto-play behavior. Error handling and caching behavior are local.
Install Mechanism
No remote download/install spec is present (instruction- and script-based skill). There are local scripts and Node files bundled with the skill; nothing pulls arbitrary code from external nonstandard hosts at install time, which keeps install risk low.
Credentials
Only declared env var is YOUTUBE_MUSIC_BROWSER_PROFILE and required binary is node — both plausible for a browser-automation skill. However, the code rarely reads that env var (scripts use a hardcoded/default profile 'openclaw'), so the declared env requirement appears unnecessary or misdocumented. No other credentials (API keys, tokens, AWS creds, etc.) are requested.
Persistence & Privilege
The skill does not request 'always: true' and will not be force-included. It creates small local cache files under /tmp (and scripts reference ~/.openclaw in docs) but does not attempt to change other skills' configs or system-wide auth. Local caches are persistent across runs but limited in scope.
Assessment
What to check before installing: - Confirm you have and trust the OpenClaw CLI/browser tool: scripts call openclaw browser commands and will try to start a browser. If you don't have OpenClaw installed, parts will fail. - The skill writes caches (e.g., /tmp/yt_music_v3_cache.json and /tmp/yt_music_v3.json). These files may contain mapping of queries to URLs/video IDs; review or clear them if you are concerned about local persistence. The skill does not exfiltrate data to external servers. - The package declares YOUTUBE_MUSIC_BROWSER_PROFILE but the v3 scripts default to the 'openclaw' profile and don't read that env var; if you expect the skill to use a different browser profile, either set the profile manually in scripts or confirm how your OpenClaw environment should expose it. - The Node scripts use child_process.execSync to call openclaw; this is expected for a browser-control skill but means commands run with the agent's privileges. Only install/run this skill in an environment you trust. - If you want lower footprint, inspect or run the bundled scripts manually first (they are contained in the skill folder) rather than enabling autonomous invocation. Overall: behavior is coherent with the stated purpose and no obvious data-exfiltration or unrelated credential access was found — treat it as functionally appropriate but verify OpenClaw tooling and the cache behavior before enabling.

Like a lobster shell, security has layers — review code before you run it.

latestvk97bjqf92fpba45njekyh5f6ad81xfjz

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

🎵 Clawdis
Binsnode
EnvYOUTUBE_MUSIC_BROWSER_PROFILE

SKILL.md

YouTube Music Control Skill 🎵

Control YouTube Music with natural language commands. Uses browser automation for full playback control.

Quick Start

# No setup needed - uses OpenClaw browser
# Optional: Set default profile in TOOLS.md

Commands

Playback Control

  • Play: "play [song name]" / "play [artist]" / "play [playlist]"
  • Pause: "pause" / "stop"
  • Resume: "resume" / "continue"
  • Skip: "skip" / "next"
  • Previous: "previous" / "back"
  • Volume: "volume 50%" / "set volume to 80"
  • Mute: "mute" / "unmute"

Search & Discovery

  • Search: "search for [query]" / "find [artist]"
  • Trending: "what's trending" / "trending now"
  • Recommendations: "recommend similar" / "more like this"

Library & Playlists

  • Playlists: "show my playlists" / "create playlist [name]"
  • Add to Playlist: "add this to [playlist]"
  • Liked Songs: "show liked songs" / "like this"

Queue Management

  • Queue: "show queue" / "what's next"
  • Add to Queue: "queue [song]"
  • Clear Queue: "clear queue"

Information

  • Now Playing: "what's playing" / "current track"
  • Lyrics: "show lyrics" / "lyrics"
  • Artist Info: "about [artist]"

Usage Examples

"play Ye Tune Kya Kiya by Javed Bashir"
"pause the music"
"skip to next track"
"set volume to 75%"
"search for Arijit Singh hits"
"add this to my workout playlist"
"what's playing now?"
"show me the lyrics"
"queue some chill Bollywood songs"

Implementation Notes

Browser Automation

Uses OpenClaw's browser tool with YouTube Music:

  • Profile: openclaw (isolated browser)
  • Base URL: https://music.youtube.com
  • CDP Port: 18800

Key Selectors (Dynamic)

Selectors are resolved via snapshot refs, not hardcoded:

  • Player controls: pause, play, skip, previous
  • Search box: combobox with placeholder
  • Volume slider: range input
  • Queue: up next panel
  • Lyrics: lyrics tab

Error Handling

  • Browser not running → Auto-start
  • Video unavailable → Suggest alternatives
  • Network issues → Retry with backoff
  • No search results → Show spelling suggestions

Advanced Features

Smart Search

  • Fuzzy matching for song names
  • Artist/album disambiguation
  • Auto-play top result if exact match

Context Awareness

  • Remembers last played track
  • Tracks listening history
  • Suggests based on time of day

Multi-Room Support

  • Cast to different devices
  • Sync playback across tabs
  • Group control (future)

Configuration

Add to TOOLS.md:

### YouTube Music
- Default profile: openclaw
- Preferred quality: high
- Auto-play: on
- Shuffle default: off

Dependencies

  • OpenClaw browser tool
  • YouTube Music (music.youtube.com)
  • No API keys required

Limitations

  • Requires browser to be running
  • Some features need YouTube Premium
  • Lyrics availability varies by region
  • Queue management limited to current session

Future Enhancements

  • YouTube Music API integration (if available)
  • Offline mode with cached tracks
  • Cross-platform sync
  • Voice control integration
  • Smart playlists based on mood/activity

Examples

Play a Song

User: "play Tuna Kay Keya"
Assistant: "Found 'Ye Tune Kya Kiya' by Javed Bashir. Playing now! 🎵"

Control Playback

User: "pause"
Assistant: "Paused. Press play to resume. ⏸️"

User: "skip"
Assistant: "Skipping to next track. ⏭️"

Search & Discover

User: "find similar to this"
Assistant: "Based on 'Ye Tune Kya Kiya', you might like:
- 'Kaise Hua' by Vishal Mishra
- 'Aankhon Se Batana' by Dikshant
- 'Kali Kali Zulfon Ke' by Madhur Sharma"

Playlist Management

User: "add this to my Bollywood Classics"
Assistant: "Added 'Ye Tune Kya Kiya' to 'Bollywood Classics' playlist. ✓"

Testing

Test the skill with:

# Test search
"search for Pritam songs"

# Test playback
"play a sample track"
"pause"
"skip"

# Test volume
"set volume to 50%"
"mute"
"unmute"

Skill Author: Your AI Assistant
License: MIT
Status: Ready for production 🚀

Files

17 total
Select a file
Select a file to preview.

Comments

Loading comments…