YouTube Transcript Extractor by AkkuAlle

Extrahiert Transkripte von YouTube-Videos für Content-Erstellung. Nutze für Video-Analysen, Content-Ideen und Blog-Posts aus YouTube-Videos.

Security Scan

The skill's declared runtime instructions (SKILL.md) largely match a YouTube transcript extractor, but there are multiple internal inconsistencies and missing pieces (missing source/install, contradictory metadata, references to a non-existent binary and 'always' enable) that make its behavior unclear and worth caution.

Purpose & Capability

The stated purpose (extract YouTube transcripts and produce content) aligns with the YOUTUBE_API_KEY requirement and the alternative yt-dlp / youtube-transcript-api approaches in the instructions. However registry metadata at the top of the package claims no required env vars while SKILL.md declares YOUTUBE_API_KEY in its metadata — this mismatch is unexplained. SKILL.md also references an executable at /root/.openclaw/skills/.../youtube-transcript but there is no install spec or code file that would create that binary, which is incoherent with the claimed installless skill.

Instruction Scope

Instructions ask the operator to store the API key in a .env and show a shell invocation that expects a local skill binary under /root/.openclaw/skills/...; but there is no code or install mechanism provided to supply that binary. The steps otherwise stay within the transcript-extraction purpose and the alternatives (yt-dlp, youtube-transcript-api) are reasonable. The presence of a hardcoded root path and expectation of an installed skill binary without an install spec is a scope/expectations mismatch.

Install Mechanism

This is instruction-only (no install spec, no code files), which is low-risk in itself. The SKILL.md suggests installing third-party tools (yt-dlp, pip package youtube-transcript-api) if no API key is available — those are normal recommendations but not enforced by an installer. The skill also references a non-provided binary path; absence of an install step for that binary is inconsistent and should be clarified.

Credentials

Requesting a YOUTUBE_API_KEY is proportionate to the stated function. However: (1) the registry summary lists no required env vars while SKILL.md requires YOUTUBE_API_KEY — an internal inconsistency; (2) SKILL.md instructs storing the key in a local .env file (which may be insecure) and does not discuss restricting key scope or alternatives. No other unrelated credentials are requested.

Persistence & Privilege

SKILL.md metadata includes always:true, which would force-enable the skill in all agents; the registry flags show always:false. This contradiction is important: if the skill really sets always:true it would be force-included across contexts, increasing blast radius. Because the registry and SKILL.md disagree, the required persistence/privilege level is unclear and should be resolved before trust.

What to consider before installing

Do not install or supply secrets to this skill until the inconsistencies are resolved. Specific steps to take: 1) Ask the publisher for the source code or a homepage — there is no source/homepage listed. 2) Ask which value of 'always' is authoritative (registry vs SKILL.md); prefer skills that are not 'always' enabled. 3) Ask how the /root/.openclaw/skills/.../youtube-transcript binary is provided and request an explicit, auditable install step (or remove the fake invocation if the skill is purely instruction-only). 4) If you test it, avoid putting a high-privilege API key in a plaintext .env — create a restricted YouTube API key (minimal quotas/referrers) or use a throwaway/test key and run in an isolated environment. 5) If you need the functionality but want assurance, prefer a skill with a public source, clear install steps, or implement the small transcript workflow yourself (yt-dlp or youtube-transcript-api) rather than trusting an opaque skill. These issues make the package suspicious rather than clearly benign.

YouTube Transcript Skill

Extrahiert Transkripte von YouTube-Videos für SEO-Content.

Setup

API-Key erforderlich:

1. Google Cloud Console öffnen
2. YouTube Data API v3 aktivieren
3. API-Key erstellen
4. In .env speichern: YOUTUBE_API_KEY=your_key

Verwendung

Via Shell Tool:

/root/.openclaw/skills/youtube-transcript/youtube-transcript "VIDEO_ID"

Beispiel:

/root/.openclaw/skills/youtube-transcript/youtube-transcript "9nnsszlfE0w"

Funktionen

1. Transkript extrahieren - Deutsches Transkript laden
2. Video-Metadaten - Titel, Beschreibung, Tags
3. Content-Ideen generieren - Aus Transkript
4. Blog-Post erstellen - Aus Video-Inhalt

Alternative ohne API

Falls kein API-Key vorhanden, nutze:

# Mit yt-dlp
yt-dlp --write-auto-sub --sub-lang de --skip-download "VIDEO_URL"

# Mit youtube-transcript-api (Python)
pip install youtube-transcript-api
python -c "from youtube_transcript_api import YouTubeTranscriptApi; print(YouTubeTranscriptApi.get_transcript('VIDEO_ID', languages=['de']))"

Use Cases

• Video-to-Blog: YouTube-Video in Blog-Post umwandeln
• Content-Ideen: Transkript für Keyword-Recherche nutzen
• Zitate extrahieren: Wichtige Aussagen finden
• FAQ generieren: Aus Video-Fragen

Beispiel-Ausgabe

## Video: Claude Code 2.0 Neue Features

**Dauer:** 12:34
**Channel:** TechChannel

### Transkript (DE):

[00:00] Willkommen zurück zu einem neuen Video...
[00:15] Heute schauen wir uns Claude Code 2.0 an...
...

### Key Points:
1. Neue Skills-Funktion
2. Loops für wiederholte Aufgaben
3. Verbesserte Code-Analyse

### Content-Ideen:
- Blog: "Claude Code 2.0: Die 5 besten neuen Features"
- Vergleich: Claude Code vs GitHub Copilot

Wann verwenden

Nutze dieses Skill wenn der User fragt:

• "Extrahiere das Transkript von diesem YouTube-Video"
• "Erstelle einen Blog-Post aus diesem Video"
• "Was sind die Key Points aus Video X?"
• "YouTube-Video analysieren"