custom-youtube-summarize
v1.0.1Extract transcript from a YouTube video using Python and summarize it.
⭐ 0· 40·0 current·0 all-time
by@5eun
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match the code: transcript_extract.py uses an embedded youtube_transcript_api library to fetch subtitles from YouTube. No unrelated environment variables, binaries, or config paths are requested. Including the library source instead of declaring it as a dependency is a packaging choice but not incoherent.
Instruction Scope
SKILL.md instructs the agent to run python3 {baseDir}/transcript_extract.py and capture output between markers '[TRANSCRIPT-START]' and '[TRANSCRIPT-END]'. The script, however, prints '[TRANSCRIPT-START\n' (missing the closing ']') and '[TRANSCRIPT-END]' — so the expected start marker does not match the actual output. Also SKILL.md tells you to create the script at {baseDir} although transcript_extract.py is already included in the package. These are functional inconsistencies (likely bugs) that will break the agent's transcript-capture step unless fixed.
Install Mechanism
No install spec (instruction-only) — lowest install risk. The skill embeds the youtube_transcript_api library source in libs/, which increases code surface but is a legitimate third-party library copy rather than fetching code from an arbitrary URL. No downloads or archive extraction are specified.
Credentials
The skill requests no environment variables or credentials. The code makes outbound HTTP(S) requests to YouTube (expected for its purpose). The bundled library contains optional proxy-related code (including references to Webshare affiliate links) but the default script does not use or require proxy credentials; proxy credentials would only be used if someone invoked the CLI with those flags.
Persistence & Privilege
Skill flags are default (always:false). It does not request permanent platform presence or modify other skills' configs. Autonomous agent invocation is allowed (platform default) but not combined with other risky factors here.
Assessment
What to consider before installing/using:
- Functional bug: The script's start marker is wrong. SKILL.md expects '[TRANSCRIPT-START]' but transcript_extract.py prints '[TRANSCRIPT-START\n'. Either fix the script to print '[TRANSCRIPT-START]\n'+text+'\n[TRANSCRIPT-END]' or update the capture logic to match the actual output. Without this fix the agent may not extract the transcript correctly.
- Network activity: The script performs outbound requests to YouTube to fetch transcripts. This is expected for the feature but be aware these requests may be rate-limited or blocked; the bundled library suggests using proxies (and has optional flags for proxy username/password) if you hit IP blocking.
- No secrets requested: The skill does not ask for environment variables or keys. Only provide proxy credentials if you intentionally configure that feature and trust the proxy provider.
- Code provenance & maintenance: The skill bundles a third-party library (youtube_transcript_api) rather than declaring it as a dependency. That increases the code you should review for licensing and timely security fixes. If you prefer, replace the bundled library with a vetted package from a package manager and pin a known-good version.
- Test before enabling: Run the included script locally with a known YouTube URL to verify behavior and ensure the transcript markers are produced as your agent's capture logic expects.
If you want, I can produce a small fixed version of transcript_extract.py (correcting the marker and optionally adding a --format or timeout) or a minimal validation checklist to run before enabling this skill.Like a lobster shell, security has layers — review code before you run it.
latestvk9715cqf4srdjp6n3ax8s3059s8462ev
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
