Youtube Search Extractor

PassAudited by ClawScan on May 10, 2026.

Overview

This skill appears to do its stated YouTube search/link-extraction job, with ordinary but noticeable browser automation, local file output, and dependency-install considerations.

This looks safe for its stated purpose if you are comfortable with browser automation against YouTube. Before installing, verify the agent-browser dependency source, use simple output filenames, and remember that generated HTML/link files may contain your search terms.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Running the skill will contact YouTube, control a browser automation tool, and save search-result HTML and link files on disk.

Why it was flagged

The skill drives the agent-browser CLI, opens YouTube, retrieves page HTML, and writes local output files. This matches the stated purpose, but it can close an existing agent-browser session and can create or overwrite files based on the chosen output name.

Skill content

subprocess.run(self.agent_browser_cmd + ['close']...); ... self.agent_browser_cmd + ['open', search_url] ... self.agent_browser_cmd + ['get', 'html', 'body']; ... open(f"{output_file}.html", 'w'

Recommendation

Use clear output filenames in the intended directory, avoid running it while other agent-browser work is active, and review generated files before sharing them.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The installed agent-browser version may change over time, so future installs may not run the exact same reviewed code path.

Why it was flagged

The skill depends on an external global npm package and uses the moving 'latest' version. This is a normal dependency for the stated browser-automation purpose, but it reduces reproducibility and requires trusting the package source.

Skill content

"install-deps": "npm install -g agent-browser && agent-browser install" ... "dependencies": { "agent-browser": "latest" }

Recommendation

Prefer a pinned agent-browser version from a trusted source and review npm/GitHub provenance before installing globally.

Note

ASI09: Human-Agent Trust Exploitation

What this means

A user could overestimate the privacy protection provided by headless mode when searching YouTube.

Why it was flagged

The README suggests headless mode avoids exposing the user's real IP address. Headless browsing does not hide network identity; only appropriate network routing such as a trusted proxy or VPN can change that exposure.

Skill content

使用`--headless`模式避免暴露真实IP

Recommendation

Do not rely on headless mode for IP privacy; use an appropriate proxy/VPN if privacy is required and assume YouTube receives the search request.