YouTube Music ULTRA

Control YouTube Music with natural language. Play, pause, skip, search, manage playlists, and queue tracks. Full playback control via browser automation.

Security Scan

The skill generally matches its stated purpose (browser-based YouTube Music control) but contains implementation inconsistencies and some risky patterns (unsafe shell/exec usage, cache files, an unused required env var) that warrant review before installing.

Purpose & Capability

Name/description, scripts, and runtime instructions all describe browser automation for YouTube Music and the required 'node' binary is justified by the included Node.js scripts. However, the declared required env var YOUTUBE_MUSIC_BROWSER_PROFILE is not actually used by the scripts (they hardcode or default to the 'openclaw' profile). This is a mismatch that should be clarified.

Instruction Scope

SKILL.md and the scripts limit actions to controlling https://music.youtube.com via the OpenClaw browser (open/start/status, open targetUrl). The skill also stores listening/cache data (in ~/.openclaw workspace and /tmp cache files) and can auto-start the browser. Those behaviors are consistent with a playback controller, but the presence of persistent caching and a claimed 'listening history' means the skill will collect and store local user activity (privacy consideration).

Install Mechanism

There is no external download/install spec (instruction-only + shipped scripts). Nothing is pulled from arbitrary remote URLs during install, so install risk is low. The code will be written into the skill workspace when added, which is expected for a script-based skill.

Credentials

The declared env var (YOUTUBE_MUSIC_BROWSER_PROFILE) appears unnecessary (unused) — mismatch is suspicious but low risk. No API keys or unrelated credentials are requested. However, the skill requires access to the OpenClaw CLI and can start/open the browser and open arbitrary targetUrl values derived from user queries; combined with several places where shell commands are built from query text (execSync / fastExec / echo into cache files), this introduces potential for command-injection or shell-escaping issues if queries are not sanitized.

Persistence & Privilege

always:false (no forced inclusion). The skill writes cache files (e.g. /tmp/yt_music_v3_cache.json, /tmp/yt_music_v3.json and files under ~/.openclaw/workspace/skills/youtube-music) and can start the OpenClaw browser/gateway. Writing local caches and auto-starting the browser are proportionate for this purpose, but remember these artifacts persist locally and could contain user activity; also the skill can autonomously open URLs (default agent invocation allowed), which expands its operational reach — worth limiting if you don't want autonomous web actions.

What to consider before installing

This skill appears to do what it says (control YouTube Music via OpenClaw's browser), but review the code before installing: 1) Confirm you trust the OpenClaw CLI and the 'openclaw browser' commands the skill runs (it can start the browser and open arbitrary URLs). 2) The metadata asks for YOUTUBE_MUSIC_BROWSER_PROFILE but the scripts default to 'openclaw' — either remove the unused env requirement or update scripts to respect it. 3) The Node.js and bash code build shell commands and write cache files from user-provided queries (echo into files, execSync/fastExec). These are correctness/privacy risks: unsanitized input could cause shell injection or malformed cache content; cache files store listening history. Inspect/validate or sanitize input handling (or run the skill in an isolated environment) before granting it access. 4) If you allow autonomous invocation, consider the privacy implications (local cache, ability to open URLs) and whether you prefer to keep the skill user-invocable only. Recommended actions: run the bundled test.sh in a sandbox, audit usages of execSync/fastExec/echo for proper escaping, and remove or correctly implement the YOUTUBE_MUSIC_BROWSER_PROFILE requirement. If you are not comfortable auditing the code yourself, run the skill in a restricted container or decline installation.

YouTube Music Control Skill 🎵

Control YouTube Music with natural language commands. Uses browser automation for full playback control.

Quick Start

# No setup needed - uses OpenClaw browser
# Optional: Set default profile in TOOLS.md

Commands

Playback Control

• Play: "play [song name]" / "play [artist]" / "play [playlist]"
• Pause: "pause" / "stop"
• Resume: "resume" / "continue"
• Skip: "skip" / "next"
• Previous: "previous" / "back"
• Volume: "volume 50%" / "set volume to 80"
• Mute: "mute" / "unmute"

Search & Discovery

• Search: "search for [query]" / "find [artist]"
• Trending: "what's trending" / "trending now"
• Recommendations: "recommend similar" / "more like this"

Library & Playlists

• Playlists: "show my playlists" / "create playlist [name]"
• Add to Playlist: "add this to [playlist]"
• Liked Songs: "show liked songs" / "like this"

Queue Management

• Queue: "show queue" / "what's next"
• Add to Queue: "queue [song]"
• Clear Queue: "clear queue"

Information

• Now Playing: "what's playing" / "current track"
• Lyrics: "show lyrics" / "lyrics"
• Artist Info: "about [artist]"

Usage Examples

"play Ye Tune Kya Kiya by Javed Bashir"
"pause the music"
"skip to next track"
"set volume to 75%"
"search for Arijit Singh hits"
"add this to my workout playlist"
"what's playing now?"
"show me the lyrics"
"queue some chill Bollywood songs"

Implementation Notes

Browser Automation

Uses OpenClaw's browser tool with YouTube Music:

• Profile: openclaw (isolated browser)
• Base URL: https://music.youtube.com
• CDP Port: 18800

Key Selectors (Dynamic)

Selectors are resolved via snapshot refs, not hardcoded:

• Player controls: pause, play, skip, previous
• Search box: combobox with placeholder
• Volume slider: range input
• Queue: up next panel
• Lyrics: lyrics tab

Error Handling

• Browser not running → Auto-start
• Video unavailable → Suggest alternatives
• Network issues → Retry with backoff
• No search results → Show spelling suggestions

Advanced Features

Smart Search

• Fuzzy matching for song names
• Artist/album disambiguation
• Auto-play top result if exact match

Context Awareness

• Remembers last played track
• Tracks listening history
• Suggests based on time of day

Multi-Room Support

• Cast to different devices
• Sync playback across tabs
• Group control (future)

Configuration

Add to TOOLS.md:

### YouTube Music
- Default profile: openclaw
- Preferred quality: high
- Auto-play: on
- Shuffle default: off

Dependencies

• OpenClaw browser tool
• YouTube Music (music.youtube.com)
• No API keys required

Limitations

• Requires browser to be running
• Some features need YouTube Premium
• Lyrics availability varies by region
• Queue management limited to current session

Future Enhancements

• YouTube Music API integration (if available)
• Offline mode with cached tracks
• Cross-platform sync
• Voice control integration
• Smart playlists based on mood/activity

Examples

Play a Song

User: "play Tuna Kay Keya"
Assistant: "Found 'Ye Tune Kya Kiya' by Javed Bashir. Playing now! 🎵"

Control Playback

User: "pause"
Assistant: "Paused. Press play to resume. ⏸️"

User: "skip"
Assistant: "Skipping to next track. ⏭️"

Search & Discover

User: "find similar to this"
Assistant: "Based on 'Ye Tune Kya Kiya', you might like:
- 'Kaise Hua' by Vishal Mishra
- 'Aankhon Se Batana' by Dikshant
- 'Kali Kali Zulfon Ke' by Madhur Sharma"

Playlist Management

User: "add this to my Bollywood Classics"
Assistant: "Added 'Ye Tune Kya Kiya' to 'Bollywood Classics' playlist. ✓"

Testing

Test the skill with:

# Test search
"search for Pritam songs"

# Test playback
"play a sample track"
"pause"
"skip"

# Test volume
"set volume to 50%"
"mute"
"unmute"

---

Skill Author: Your AI Assistant
License: MIT
Status: Ready for production 🚀