ClawHub

YouTube Channel Banner

v0.10.7-dev

Manage YouTube channel banners. Use this skill to insert or upload channel banners. Useful when working with YouTube channel banner — provides commands to in...

⭐ 0· 201·0 current·0 all-time
by@openwaygate
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Skill name/description map directly to the yutu CLI and YouTube API usage. Declared binaries (yutu), OAuth credential files (client_secret.json, youtube.token.json), and env vars (YUTU_CREDENTIAL, YUTU_CACHE_TOKEN) are appropriate and expected for a YouTube banner upload utility.
✓
Instruction Scope
SKILL.md and referenced docs only instruct installing/using yutu, performing channelBanner insert operations, and setting up OAuth. The instructions reference only the declared config files and env vars and do not request unrelated system files, hidden endpoints, or broad data collection.
ℹ
Install Mechanism
Install spec uses an npm package (@eat-pray-ai/yutu) that provides the yutu binary — consistent with the skill. As with any global npm package, installation can run arbitrary install scripts (postinstall hooks); this is a standard supply-chain risk but not disproportionate to the skill's purpose. The docs also mention brew/winget/go binaries and GitHub releases as alternate install routes.
✓
Credentials
Requested env vars and config paths (YUTU_CREDENTIAL, YUTU_CACHE_TOKEN, client_secret.json, youtube.token.json) are proportional and required for OAuth-based YouTube API access. No unrelated credentials or broad secret access is requested.
✓
Persistence & Privilege
Skill is user-invocable, not always-enabled, and allows normal autonomous invocation — standard for skills. It does not request elevated system-wide persistence or modify other skills' configs.
Assessment
This skill appears internally consistent: it wraps the yutu CLI and needs OAuth client credentials + a cached token to call the YouTube API. Before installing, verify the npm package / GitHub repo (https://github.com/eat-pray-ai/yutu) is trustworthy, because npm installs may execute install-time scripts. Confirm you’re comfortable granting the OAuth scopes when yutu opens a browser for auth, and avoid placing client_secret.json or youtube.token.json in shared/public repos. If you prefer lower risk, install via a prebuilt binary from the project's releases page (verify checksums) rather than a global npm install.

Like a lobster shell, security has layers — review code before you run it.

0.10.6-3vk976aw3cjh4kjw73c5myegccrx82rmvf0.10.7-devvk974thgcz9nw4gsrcdg45g9dth82wvhxlatestvk974thgcz9nw4gsrcdg45g9dth82wvhx

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬🐰 Clawdis
Binsyutu
EnvYUTU_CREDENTIAL, YUTU_CACHE_TOKEN
Configclient_secret.json, youtube.token.json
Primary envYUTU_CREDENTIAL

Install

Node
Bins: yutu
npm i -g @eat-pray-ai/yutu

Comments