Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Youtube Api

YouTube API access without the official API quota hassle — transcripts, search, channels, playlists, and metadata with no Google API key needed. Use when the user needs YouTube data programmatically, wants to avoid Google API quotas, or asks for "youtube api", "get video data", "youtube without api key", "no quota youtube".

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 3.5k · 5 current installs · 5 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (YouTube data via TranscriptAPI) match the required pieces: node binary for the provided JS CLI and a TRANSCRIPT_API_KEY. Requiring ~/.openclaw/openclaw.json is consistent with the skill saving the API key there.
Instruction Scope
SKILL.md instructs only: prompt user for email/OTP, run scripts/tapi-auth.js to register/verify, and call transcriptapi.com endpoints via curl. The instructions only reference TRANSCRIPT_API_KEY and ~/.openclaw/openclaw.json (both declared). No unrelated file reads, environment access, or external endpoints are present.
Install Mechanism
No install spec (instruction-only) and one included CLI script. This is low-risk: nothing is downloaded from arbitrary URLs and no archives are extracted. Requiring node is proportionate to the shipped JS script.
Credentials
Only TRANSCRIPT_API_KEY is required and declared as the primary credential. The script stores that key in the declared OpenClaw config path. No other unrelated secrets or credentials are requested.
Persistence & Privilege
always is false and the skill only writes to its own OpenClaw config (~/.openclaw/openclaw.json), backing up the existing file to .bak. It does not request system-wide privileges or modify other skills' configs.
Assessment
This skill appears internally consistent, but note: it sends requests to transcriptapi.com (you must trust that third party), and the CLI will save your API key in plain JSON at ~/.openclaw/openclaw.json (the file is backed up to .openclaw/openclaw.json.bak). Before installing, verify TranscriptAPI's reputation and privacy policy, ensure your machine's ~/.openclaw directory is secure, and understand that any queries/transcripts you send go to transcriptapi.com rather than Google. If you prefer not to store keys in a local file, plan to set TRANSCRIPT_API_KEY manually in your environment instead of using the provided save flow.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.4.1
Download zip
latestvk97fb163pe5pqdq5rrm28scjbn80yb9w

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

Clawdis
Binsnode
EnvTRANSCRIPT_API_KEY
Config~/.openclaw/openclaw.json
Primary envTRANSCRIPT_API_KEY

SKILL.md

YouTube API

YouTube data access via TranscriptAPI.com — no Google API quota needed.

Setup

If $TRANSCRIPT_API_KEY is not set, help the user create an account (100 free credits, no card):

Step 1 — Register: Ask user for their email.

node ./scripts/tapi-auth.js register --email USER_EMAIL

→ OTP sent to email. Ask user: "Check your email for a 6-digit verification code."

Step 2 — Verify: Once user provides the OTP:

node ./scripts/tapi-auth.js verify --token TOKEN_FROM_STEP_1 --otp CODE

API key saved to ~/.openclaw/openclaw.json. See File Writes below for details. Existing file is backed up before modification.

Manual option: transcriptapi.com/signup → Dashboard → API Keys.

File Writes

The verify and save-key commands save the API key to ~/.openclaw/openclaw.json (sets skills.entries.transcriptapi.apiKey and enabled: true). Existing file is backed up to ~/.openclaw/openclaw.json.bak before modification.

To use the API key in terminal/CLI outside the agent, add to your shell profile manually: export TRANSCRIPT_API_KEY=<your-key>

API Reference

Full OpenAPI spec: transcriptapi.com/openapi.json — consult this for the latest parameters and schemas.

Endpoint Reference

All endpoints: https://transcriptapi.com/api/v2/youtube/...

Channel endpoints accept channel — an @handle, channel URL, or UC... ID. Playlist endpoints accept playlist — a playlist URL or ID.

EndpointMethodCost
/transcript?video_url=IDGET1
/search?q=QUERY&type=videoGET1
/channel/resolve?input=@handleGETfree
/channel/latest?channel=@handleGETfree
/channel/videos?channel=@handleGET1/page
/channel/search?channel=@handle&q=QGET1
/playlist/videos?playlist=PL_IDGET1/page

Quick Examples

Search videos:

curl -s "https://transcriptapi.com/api/v2/youtube/search\
?q=python+tutorial&type=video&limit=10" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"

Get transcript:

curl -s "https://transcriptapi.com/api/v2/youtube/transcript\
?video_url=dQw4w9WgXcQ&format=text&include_timestamp=true&send_metadata=true" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"

Resolve channel handle (free):

curl -s "https://transcriptapi.com/api/v2/youtube/channel/resolve?input=@TED" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"

Latest videos (free):

curl -s "https://transcriptapi.com/api/v2/youtube/channel/latest?channel=@TED" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"

Browse channel uploads (paginated):

curl -s "https://transcriptapi.com/api/v2/youtube/channel/videos?channel=@NASA" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"
# Use continuation token from response for next pages

Browse playlist (paginated):

curl -s "https://transcriptapi.com/api/v2/youtube/playlist/videos?playlist=PL_PLAYLIST_ID" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"

Parameter Validation

FieldRule
channel@handle, channel URL, or UC... ID
playlistPlaylist URL or ID (PL/UU/LL/FL/OL prefix)
q (search)1-200 chars
limit1-50
continuationnon-empty string

Why Not Google's API?

Google YouTube Data APITranscriptAPI
Quota10,000 units/day (100 searches)Credit-based, no daily cap
SetupOAuth + API key + projectSingle API key
TranscriptsNot availableCore feature
Pricing$0.0015/unit overage$5/1000 credits

Errors

CodeMeaningAction
401Bad API keyCheck key
402No creditstranscriptapi.com/billing
404Not foundResource doesn't exist
408Timeout/retryableRetry once after 2s
422Validation errorCheck param format
429Rate limitedWait, respect Retry-After

Free tier: 100 credits, 300 req/min. Starter ($5/mo): 1,000 credits.

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…