ClawHub

YouTube Caption

v0.10.7-dev

Manage YouTube video captions. Use this skill to list, insert, update, download, or delete video captions. Useful when working with YouTube caption — provide...

⭐ 0· 223·0 current·0 all-time
by@openwaygate
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the requirements: the skill needs the yutu CLI, OAuth client secret/token files, and env vars for the yutu tool — all of which are appropriate for managing YouTube captions via the YouTube Data API.
✓
Instruction Scope
SKILL.md only instructs the agent to use the yutu CLI to list/insert/update/download/delete captions and to run the yutu auth flow to obtain an OAuth token; it does not ask the agent to read unrelated system files or exfiltrate data to unexpected endpoints. The auth flow will open a browser and save a local token (youtube.token.json), which is expected for OAuth.
ℹ
Install Mechanism
Install spec uses an npm package (@eat-pray-ai/yutu) which matches the GitHub homepage; this is a common, expected mechanism (moderate risk vs. system packages). The setup doc also documents alternative installation methods (brew/winget/go/releases) though only the node install is declared in the install spec — not harmful but a minor documentation/metadata mismatch to be aware of.
✓
Credentials
Requested env vars (YUTU_CREDENTIAL, YUTU_CACHE_TOKEN) and config paths (client_secret.json, youtube.token.json) directly map to OAuth client credentials and cached tokens required to call the YouTube API. The scope and number of credentials are proportionate to the described functionality.
✓
Persistence & Privilege
always:false (no forced presence). The skill does not request elevated system-wide privileges or modification of other skills. It will rely on locally stored OAuth tokens created by the yutu auth flow, which is normal for a CLI tool.
Assessment
This skill appears to be what it says: a wrapper around the yutu CLI for YouTube caption management. Before installing: (1) review the npm package and GitHub repo (@eat-pray-ai/yutu) to ensure you trust the publisher; (2) understand that you must provide OAuth client credentials and will grant YouTube API access — the tool will open a browser and write a local token file (youtube.token.json); keep those files private; (3) prefer installing with a trusted package manager or inspect the package contents before global install; and (4) if you are concerned about autonomous agent invocation, be aware the platform allows skills to be invoked by agents by default — you can restrict or review skill usage in your agent settings.

Like a lobster shell, security has layers — review code before you run it.

0.10.6-3vk975asmzzy16yh5mfycc73c0qd82rj1t0.10.7-devvk97ckcs3sm6vc1wg427gwt3rdd82wd2tlatestvk97ckcs3sm6vc1wg427gwt3rdd82wd2t

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬🐰 Clawdis
Binsyutu
EnvYUTU_CREDENTIAL, YUTU_CACHE_TOKEN
Configclient_secret.json, youtube.token.json
Primary envYUTU_CREDENTIAL

Install

Node
Bins: yutu
npm i -g @eat-pray-ai/yutu

Comments