Youtube Channel Monitor

YouTube 频道订阅+自动摘要+Telegraph 发布工具。用于： 1. 定时监控指定 YouTube 频道的新视频 2. 提取视频字幕（支持中英双语） 3. 生成可读性强的中文专栏文章 4. 自动发布到 Telegraph 并推送到 Telegram 频道 触发场景： - 用户想订阅 YouTube 频道...

Security Scan

The skill mostly does what it claims (monitor YouTube, extract/translate subtitles, create Telegraph posts) but contains hardcoded Telegram credentials and fixed remote targets that will publish content to an external channel without requiring or declaring user credentials—this inconsistency is a serious privacy/operational risk.

Purpose & Capability

The code implements the stated functionality (checking channels, fetching transcripts, translating, creating Telegraph pages, pushing to Telegram). Dependencies listed in SKILL.md (yt-dlp, youtube-transcript-api, requests) match the script's behavior. However, the script hardcodes a Telegram bot token and a Telegram channel id instead of using user-provided credentials or declared environment variables, which is not proportionate to a 'user-subscribe-to-your-channels' utility and deviates from expected design.

Instruction Scope

SKILL.md instructs the agent/user to run a script and references configuration files under ~/.openclaw/workspace, but the script uses absolute paths (/home/t/.openclaw/...) which may not match the runtime environment. More importantly, the runtime actions include posting generated content to an externally owned Telegram bot/channel (hardcoded token and channel id) and creating Telegraph accounts/pages — the instructions do not make it explicit that content will be sent to someone else's Telegram, nor do they explain the hardcoded token. The script will read and write local state and token files in the workspace, which is expected, but sending content externally without clearly declared credentials is unexpected and risky.

Install Mechanism

This is an instruction-only skill with no install spec (no packages are automatically downloaded). The script expects external Python packages and yt-dlp to be installed; that matches SKILL.md. No remote install URLs or archive extracts are used.

Credentials

The skill declares no required environment variables or primary credential, yet the script contains a hardcoded Telegram bot token (token value present in code) and a hardcoded TELEGRAM_CHANNEL id (-1003899234137). It also assumes a local HTTP proxy at 127.0.0.1:7897. Requesting no credentials while embedding an actual credential is a mismatch and a red flag: it gives the skill the ability to publish/exfiltrate content to an external Telegram destination controlled by whoever owns that token.

Persistence & Privilege

The skill does not request always:true and does not modify other skills. It writes state files and a telegraph_token.json into the workspace directory (normal for this functionality). Autonomous invocation is allowed (platform default). Combined with the hardcoded credentials, autonomous invocation increases the blast radius because the skill could regularly push content to the external Telegram channel without further user interaction.

Scan Findings in Context

[hardcoded-telegram-token] unexpected: The script contains a hardcoded Telegram bot token (string assigned to variable 'token') and a hardcoded TELEGRAM_CHANNEL id. For a subscription/publish tool, it should accept the user's token or a configurable destination rather than embedding a credential that routes content to a third-party channel.

What to consider before installing

Do not install or run this skill until you are comfortable with who controls the hardcoded Telegram bot. The script will publish generated content to a specific Telegram channel using a bot token embedded in the code, meaning your subscribed video summaries could be sent to an external party. Recommended actions before using: 1) Inspect and remove the hardcoded token (rotate it if it's yours), 2) Replace the hardcoded TELEGRAM_CHANNEL and token with configuration (environment variables or a user-provided config file) and document that behavior in SKILL.md, 3) Verify the absolute paths (/home/t/...) match your environment or change to use ~ or configurable workspace path, 4) Run the script in an isolated environment or sandbox first and monitor outbound network calls, 5) If you do not control the embedded bot token, consider rejecting this skill or asking the publisher to provide a version that uses user-supplied credentials. If you want, I can provide a secure patch that removes the hardcoded token and makes Telegram destination and credentials configurable.

YouTube 频道监控

定时检查频道更新，自动生成 Telegraph 文章推送。

快速开始

订阅新频道

直接发送 YouTube 频道链接给我，格式支持：

• https://www.youtube.com/@username
• https://www.youtube.com/channel/CHANNEL_ID

查看订阅列表

cat ~/.openclaw/workspace/youtube-channels.json

手动检查更新

python3 ~/.openclaw/workspace/skills/youtube-channel-monitor/scripts/youtube-monitor.py

配置说明

配置文件位于 ~/.openclaw/workspace/youtube-channels.json：

[
  {"url": "https://www.youtube.com/channel/xxx", "name": "频道名称"}
]

参数设置

在脚本中可调整：

• MAX_SUBTITLE_RETRIES = 3 - 字幕检查重试次数
• PROXY - HTTP 代理地址
• TELEGRAM_CHANNEL - 推送目标频道

工作流程

1. 每小时检查订阅频道的最新视频
2. 首次发现新视频时尝试获取字幕
3. 如果无字幕，等待下次检查再试（最多3次）
4. 获得字幕后：
   • 中文字幕：直接生成摘要
   • 英文字幕：自动翻译成中文
5. 使用 humanize-ai-text 去 AI 味
6. 发布到 Telegraph
7. 推送到 Telegram 频道

依赖

• yt-dlp - 视频信息获取
• youtube-transcript-api - 字幕提取
• requests - HTTP 请求
• 本地代理 (Clash 7897) - 用于访问 YouTube