Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Chromecast With Google Tv

v1.2.0

Cast YouTube videos, Tubi TV show episodes, and TV show episodes from other video streaming apps via ADB to Chromecast with Android TV (Chromecast 4K supported, Google TV Streamer support is unknown)

0· 1.5k·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for antgly/chromecast-with-google-tv.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Chromecast With Google Tv" (antgly/chromecast-with-google-tv) from ClawHub.
Skill page: https://clawhub.ai/antgly/chromecast-with-google-tv
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: adb, scrcpy, uv, yt-api
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install chromecast-with-google-tv

ClawHub CLI

Package manager switcher

npx clawhub@latest install chromecast-with-google-tv
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Required binaries (adb, scrcpy, yt-api, uv) and the brew/go install steps match the described functionality (ADB device pairing/control, UI fallback via scrcpy, YouTube ID resolution via yt-api). No unrelated cloud credentials or surprising privileges are requested.
Instruction Scope
Runtime instructions stay within the stated scope: they pair/connect via adb, launch intents for YouTube/Tubi, and perform UI automation for global-search via scrcpy + adb. The skill writes a local cache (.last_device.json) containing ip/port (documented). The SKILL.md mentions using a 'web_search' helper to canonicalize Tubi URLs but the repository does not include a dedicated web_search component — this is a minor documentation vagueness, not an obvious exfiltration step. Environment variables referenced (CHROMECAST_HOST, CHROMECAST_PORT, YOUTUBE_PACKAGE, TUBI_PACKAGE) are configuration-only and not secrets.
Install Mechanism
Install entries use Homebrew formulas for platform tools/scrcpy/uv and a go module for yt-api (github.com/nerveband/youtube-api-cli). These are traceable, standard mechanisms for the declared dependencies; no arbitrary downloads or extract-from-unknown-URLs were found.
Credentials
The skill requires no credentials or secret env vars. Optional env vars are configuration flags (device IP/port and package overrides). Saving the last-used device IP:PORT locally is appropriate for usability but note it records local network addressing information.
Persistence & Privilege
The skill does not request always:true and does not attempt to modify other skills or system-wide agent settings. It persists only its own .last_device.json cache in the skill folder and relies on user-installed binaries.
Scan Findings in Context
[prompt-injection:you-are-now] expected: Scanner flagged the substring pattern 'you-are-now' found in the SKILL.md. This appears in the pairing instructions ('You are now a developer!') shown when enabling Developer Options and is benign in this context.
Assessment
This skill appears to do what it says: control a Chromecast with Google TV over ADB. Before installing, verify you are comfortable enabling Developer Options and Wireless Debugging on the Chromecast (pairing exposes an adb pairing flow). Review and be comfortable with the install steps (Homebrew and a go binary for yt-api). The skill will store the last-connected device IP:PORT in .last_device.json in the skill folder — don't commit or share that file if it contains private network info. The SKILL.md mentions a 'web_search' lookup flow for Tubi URLs which is not present as a separate service in the repository; expect that behavior to be limited or manual. If you run this in an environment where arbitrary ADB commands are sensitive, audit the code (google_tv_skill.py and play_show_via_global_search.py) yourself — they use subprocess/adb to send intents and key events, which is expected for this functionality. Autonomous invocation (the agent calling the skill) is allowed by default; that is normal but if you want to restrict automatic runs, disable autonomous invocation in your agent settings.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

OSmacOS · Linux
Binsadb, scrcpy, uv, yt-api

Install

Install adb (android-platform-tools)
Bins: adb
Install scrcpy
Bins: scrcpy
brew install scrcpy
Install uv
Bins: uv
brew install uv
Install yt-api (go)
Bins: yt-api
go install github.com/nerveband/youtube-api-cli/cmd/yt-api@latest
latestvk97bv655r3yn8bb0avvbts3mtx8136fc
1.5kdownloads
0stars
4versions
Updated 12h ago
v1.2.0
MIT-0
macOS, Linux

Chromecast with Google TV control

Use this skill when I ask to cast YouTube or Tubi video content, play or pause Chromecast media playback, check if the Chromecast is online, launch episodic content in another streaming app via global search fallback, or pair with a Chromecast device for the first time.

Setup

This skill runs with uv, adb, yt-api, and scrcpy in the PATH. No venv required.

  • Ensure uv, adb, yt-api, and scrcpy are available in the PATH.
  • Use ./run as a convenience wrapper around uv run google_tv_skill.py.

First-time pairing

Before using this skill, you must pair your Chromecast with ADB wireless debugging:

  1. Enable Developer Options on the Chromecast (Settings > System > About > tap "Android TV OS build" 7 times)
  2. Enable USB debugging and Wireless debugging in Developer options
  3. Use the pair command to pair with the pairing code shown on screen:
    • ./run pair --show-instructions - Display detailed pairing instructions
    • ./run pair --pairing-ip <IP> --pairing-port <PORT> --pairing-code <CODE> - Perform pairing

After pairing once, you can use the connection port shown on the Wireless debugging screen for all other commands.

Capabilities

This skill provides a small CLI wrapper around ADB to control a Google TV device. It exposes the following subcommands:

  • pair: pair with Chromecast using wireless debugging (first-time setup)
  • status: show adb devices output
  • play <query_or_id_or_url>: play content via YouTube, Tubi, or global-search fallback.
  • pause: send media pause
  • resume: send media play

Usage examples

./run pair --show-instructions

./run pair --pairing-ip 192.168.1.100 --pairing-port 12345 --pairing-code 123456

./run status --device 192.168.4.64 --port 5555

./run play "7m714Ls29ZA" --device 192.168.4.64 --port 5555

./run play "family guy" --app hulu --season 3 --episode 4 --device 192.168.4.64 --port 5555

./run pause --device 192.168.4.64 --port 5555

Device selection and env overrides

  • You can pass --device (IP) and --port on the CLI.
  • Alternatively, set CHROMECAST_HOST and CHROMECAST_PORT environment variables to override defaults.
  • If you provide only --device or only --port, the script will use the cached counterpart when available; otherwise it will error.
  • The script caches the last successful IP:PORT to .last_device.json in the skill folder and will use that cache if no explicit device is provided.
  • If no explicit device is provided and no cache exists, the script will attempt ADB mDNS service discovery and use the first IP:PORT it finds.
  • IMPORTANT: This skill does NOT perform any port probing or scanning. It will only attempt an adb connect to the explicit port provided or the cached port.

YouTube handling

  • If you provide a YouTube video ID or URL, the skill will launch the YouTube app directly via an ADB intent restricted to the YouTube package.
  • The skill attempts to resolve titles/queries to a YouTube video ID using the yt-api CLI (in the PATH). If ID resolution fails, the skill will report failure.
  • You can override the package name with YOUTUBE_PACKAGE (default com.google.android.youtube.tv).

Tubi handling

  • If you provide a Tubi https URL, the skill will send a VIEW intent with that URL (restricted to the Tubi package).
  • If the canonical Tubi https URL is needed, the skill can look it up via web_search and supply it to this skill.
  • You can override the package name with TUBI_PACKAGE (default com.tubitv).

Global-search fallback for non-YouTube/Tubi

  • If YouTube/Tubi resolution does not apply and you pass --app with another provider (for example hulu, max, disney+), the skill uses a Google TV global-search fallback.
  • For this fallback, pass all three: --app, --season, and --episode.
  • scrcpy must be installed and available in the PATH for this flow.
  • The fallback starts android.search.action.GLOBAL_SEARCH, waits for the Series Overview UI, opens Seasons, picks season/episode, then confirms Open in <app> when available.
  • Hulu profile-selection logic is intentionally not handled here.

Pause / Resume

./run pause ./run resume

Dependencies

  • The script uses only the Python standard library (no pip packages required).
  • The scripts run through uv to avoid PEP 668/system package constraints.
  • The script expects adb, scrcpy, uv, and yt-api to be installed and available in the PATH.

Caching and non-destructive defaults

  • The script stores the last successful device (ip and port) in .last_device.json in the skill folder.
  • It will not attempt port scanning; this keeps behavior predictable and avoids conflicts with Google's ADB port rotation.

Troubleshooting

  • If adb connect fails, run adb connect IP:PORT manually from your host to verify the current port.
  • If adb connect is refused and you're running interactively, the script will prompt you for a new port and update .last_device.json on success.
  • Connection refused after pairing: If connection is refused:
    • Verify Wireless debugging is still enabled on the Chromecast
    • The device may need to be re-paired if it was restarted or Wireless debugging was toggled off
    • The interactive prompt will offer options to retry with a different port or re-pair
    • Use ./run pair --show-instructions for detailed setup steps

Implementation notes

  • The skill CLI code lives in google_tv_skill.py in this folder. It uses subprocess calls to adb, scrcpy, and yt-api, plus an internal global-search helper for fallback playback.
  • For Tubi URL discovery, the assistant uses web_search to find canonical Tubi pages and pass the https URL to the skill.

Comments

Loading comments...