ClawHub

YouTube Subscription

v0.10.7-dev

Manage YouTube subscriptions. Use this skill to list subscriptions/subscribers, subscribe to channels, or unsubscribe. Useful when working with YouTube subsc...

⭐ 0· 181·0 current·0 all-time
by@openwaygate
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the runtime instructions and required items: a yutu CLI plus Google OAuth credentials and a cached token are exactly what a YouTube subscription manager needs.
✓
Instruction Scope
SKILL.md and reference docs only instruct using the yutu CLI and its auth flow (yutu auth). They do not ask the agent to read unrelated files or send data to endpoints outside YouTube/GCP.
✓
Install Mechanism
Install spec references an npm package @eat-pray-ai/yutu which produces the required yutu binary; the README also documents official releases/brew/winget options. No arbitrary download URLs or extract-from-unknown-host installs are used.
✓
Credentials
Required environment variables (YUTU_CREDENTIAL, YUTU_CACHE_TOKEN) and config paths (client_secret.json, youtube.token.json) are directly related to OAuth authorization for YouTube and are proportionate to the stated functionality.
✓
Persistence & Privilege
always is false and the skill does not request elevated system persistence or modify other skills; autonomous invocation is allowed but is the normal platform default and not combined with other concerns here.
Assessment
This skill appears coherent with its purpose, but before installing: (1) Inspect the upstream project (https://github.com/eat-pray-ai/yutu) to verify maintainership, recent releases, and issues; (2) prefer installing via your platform package manager (brew/winget) or a vetted npm registry rather than running unknown binaries; (3) only supply OAuth credentials with the minimal scopes needed and avoid placing long-lived secrets in global env vars if possible; (4) keep youtube.token.json in a secure location and consider a dedicated account for automation; (5) if you need stronger assurance, review the yutu package source code or run it in an isolated environment/container before giving it access to your primary Google account.

Like a lobster shell, security has layers — review code before you run it.

0.10.6-3vk971av0qta28gb9wwa1ys0zxgx82s6w90.10.7-devvk97fmwhbw3qjqj64gkmt02vcth82xpsvlatestvk97fmwhbw3qjqj64gkmt02vcth82xpsv

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬🐰 Clawdis
Binsyutu
EnvYUTU_CREDENTIAL, YUTU_CACHE_TOKEN
Configclient_secret.json, youtube.token.json
Primary envYUTU_CREDENTIAL

Install

Node
Bins: yutu
npm i -g @eat-pray-ai/yutu

Comments