Youtube Knowledge Extractor

PassAudited by ClawScan on May 1, 2026.

Overview

The skill’s visible instructions coherently download and analyze YouTube video transcripts and frames, with only expected local tools and package-install considerations.

This skill appears safe to install for its stated purpose. Expect it to install/use yt-dlp, ffmpeg, python3, and curl, and to download YouTube media, transcripts, and extracted frames into a temporary local directory when you ask it to analyze a video.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Using the skill can download video data and process frames locally, consuming bandwidth, disk space, and compute.

Why it was flagged

The skill uses local CLI tools to download and process video content from a user-provided YouTube URL. This is expected for the stated video-analysis purpose, but it is still meaningful local tool and network activity.

Skill content

yt-dlp -f "bestvideo[height<=720]+bestaudio/best[height<=720]" \
       -o "$WORK_DIR/video.mp4" "$VIDEO_URL"

Recommendation

Use it only for videos you intend to analyze, and be aware that media files and extracted frames are created in a temporary working directory.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The installed yt-dlp package becomes part of the skill’s trusted toolchain for fetching YouTube metadata, subtitles, and video.

Why it was flagged

The skill depends on installing an external package, yt-dlp, without an explicit version pin in the provided metadata. This is purpose-aligned but is a dependency users should recognize.

Skill content

install:
  - kind: uv
    package: yt-dlp
    bins: [yt-dlp]

Recommendation

Install dependencies from trusted sources and consider pinning or reviewing the yt-dlp version in controlled environments.

Low

#ASI05: Unexpected Code Execution

What this means

The agent may run local commands and Python snippets while performing the requested analysis.

Why it was flagged

The workflow includes shell pipelines and Python one-liners to parse YouTube metadata and subtitles. This is expected for an instruction-only media extraction skill, but it is still local code execution.

Skill content

yt-dlp --dump-json "$VIDEO_URL" 2>/dev/null | python3 -c "
import json, sys
data = json.load(sys.stdin)

Recommendation

Review the commands before use in sensitive environments and keep required tools updated.