Back to skill
Skillv1.0.0
ClawScan security
Youtube Search Extractor · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 26, 2026, 3:58 PM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, instructions, and requirements are consistent with its stated purpose (automating YouTube searches and extracting video links); nothing in the package asks for unrelated credentials or hidden network endpoints.
- Guidance
- This skill appears to do what it says: it automates a browser (via agent-browser) to fetch YouTube search result HTML and extracts links locally. Before installing or running it: 1) Verify you trust 'agent-browser' (the skill asks you to install it globally via npm) — global npm installs modify your system PATH; consider auditing or pinning a specific version rather than using 'latest'. 2) Be aware of YouTube's Terms of Service and rate limits; the tool can be used to scrape pages so avoid high-frequency requests and consider proxy/pool management if you must. 3) Run the code in a sandbox or isolated environment if you are unsure, and inspect any third-party packages you install. 4) If you need higher assurance, ask for a provenance/commit history (the repo URL shown in README points to GitHub; confirm the repo contents and maintainer) or request a version that pins dependencies rather than 'latest'.
Review Dimensions
- Purpose & Capability
- okThe skill is a YouTube search-and-extract tool implemented as a Python script that automates a browser via the external 'agent-browser' tool. The requirement for node/npm is justified in the documentation because 'agent-browser' is installed via npm; although the runtime driver is Python, requiring node/npm to install the browser automation tool is coherent.
- Instruction Scope
- okSKILL.md and the Python code restrict behavior to opening YouTube search result pages, retrieving HTML via 'agent-browser', extracting links with regex, and saving local files. The instructions do not ask the agent to read unrelated files or environment variables, nor to transmit data to third-party endpoints beyond YouTube and standard package repos referenced for agent-browser.
- Install Mechanism
- noteThis is an instruction-only skill with no automated install spec. The README instructs users to install 'agent-browser' via npm (global install). That is a reasonable but higher-friction install step: global npm installs affect the host, and package.json pins 'agent-browser' to 'latest' (un-pinned), which is a maintainability / supply-chain hygiene note rather than a direct incoherence. No opaque download URLs or extract operations are present in the skill itself.
- Credentials
- okThe skill requires no environment variables or credentials. It calls only the 'agent-browser' binary and interacts with public YouTube pages. No sensitive host credentials or unrelated service tokens are requested.
- Persistence & Privilege
- okThe skill does not request always:true and does not modify other skills or system-wide agent settings. It runs on demand and cleans up (attempts to close agent-browser sessions). Autonomous invocation is enabled by default and is expected for skills; this skill's scope does not combine that with broad privileges.