Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

youtube

v1.0.0

Search YouTube videos, get channel info, fetch video details and transcripts using SkillBoss API Hub or yt-dlp fallback.

0· 65·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for tobeyrebecca/godfery-yt.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "youtube" (tobeyrebecca/godfery-yt) from ClawHub.
Skill page: https://clawhub.ai/tobeyrebecca/godfery-yt
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: yt-dlp
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install godfery-yt

ClawHub CLI

Package manager switcher

npx clawhub@latest install godfery-yt
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name and description (YouTube search, channel/info, transcripts) align with requiring a SkillBoss API key and yt-dlp for fallback. It also depends on an npm package (zubeid-youtube-mcp-server) referenced in the SKILL.md, which is consistent with using an MCP server. However, the metadata/requirements only list yt-dlp as a required binary and do not declare other runtime tools used in the instructions (mcporter, node, git, npm, pip), creating a declaration mismatch.
!
Instruction Scope
SKILL.md instructs the agent/user to npm install -g a package, pip install yt-dlp, and potentially git clone a GitHub repo and build/run its code (node dist/cli.js) using mcporter. Those instructions involve downloading and executing third-party code and call an external MCP service (SkillBoss). They also reference mcporter in many example commands but mcporter is not listed as a required binary. The instructions ask the agent to read transcript files from /tmp and to place an API key in env or a local clawdbot config — functionalityally reasonable, but the download/build/run steps broaden the runtime surface and require explicit user review.
Install Mechanism
There is no formal install spec in the registry (instruction-only skill). The SKILL.md recommends installing an npm package, pip-installing yt-dlp, and cloning a GitHub repo if the MCP package fails. These are typical for this purpose but introduce moderate risk because they rely on third-party packages/repos being trustworthy — the skill does not pin versions or provide checksums and does not declare mcporter/npm/git/pip as required tools.
Credentials
The only declared primary credential is SKILLBOSS_API_KEY which is appropriate for calling SkillBoss API Hub. No other credentials or unrelated env vars are requested. The SKILL.md suggests storing the key in an env var or in a local clawdbot config file; both are reasonable but the user should avoid committing keys to disk in public locations.
Persistence & Privilege
The skill does not request always:true and is user-invocable. It does not ask to modify other skills or system-wide settings. Autonomous invocation is allowed by default but is not, by itself, an additional red flag here.
What to consider before installing
This skill appears to do what it says (YouTube search and transcripts) and reasonably needs a SkillBoss API key plus yt-dlp for fallback. However, before installing or running it you should: 1) Verify the npm package (zubeid-youtube-mcp-server) and the GitHub repository (https://github.com/ZubeidHendricks/youtube-mcp-server) manually — inspect the source and check npm publish history; 2) Note that SKILL.md expects tools not declared as required (mcporter, node, git, npm, pip). Ensure you have/allow only the tools you trust; 3) Be cautious about running git clone/npm install from unreviewed repos — do this in a sandbox/container if possible; 4) Use a scoped or limited SkillBoss API key, avoid committing it to public files, and rotate it if you suspect misuse; 5) If you want higher assurance, ask the skill author to: add an explicit install spec, declare all required binaries (mcporter, node, git, pip), pin package versions, and include checksums or the code as files so the registry scanner can analyze them. If those fixes are made my confidence could increase.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📹 Clawdis
Binsyt-dlp
Primary envSKILLBOSS_API_KEY
aivk97atdqqxfjgg98649ceyptrvx84yqzelatestvk97atdqqxfjgg98649ceyptrvx84yqze
65downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

YouTube Research & Transcription

Search YouTube, get video/channel info, and fetch transcripts via SkillBoss API Hub.

Features

  • 📹 Video details (title, description, stats, publish date)
  • 📝 Transcripts with timestamps
  • 📺 Channel info and recent videos
  • 🔍 Search within YouTube
  • 🎬 Playlist info

Setup

1. Install dependencies

MCP Server (primary method):

npm install -g zubeid-youtube-mcp-server

Fallback tool (if MCP fails):

# yt-dlp for transcript extraction
pip install yt-dlp

2. Get SkillBoss API Key

  1. Go to SkillBoss API Hub
  2. Sign in and navigate to your API settings
  3. Copy your API key from the dashboard

3. Configure API Key

Option A: Environment variable (recommended)

export SKILLBOSS_API_KEY="your-skillboss-api-key"

Option B: Clawdbot config Add to ~/.clawdbot/clawdbot.json:

{
  "skills": {
    "entries": {
      "youtube": {
        "apiKey": "your-skillboss-api-key"
      }
    }
  }
}

4. Setup MCP Server

The skill will use mcporter to call the YouTube MCP server:

# Build from source (if installed package has issues)
cd /tmp
git clone https://github.com/ZubeidHendricks/youtube-mcp-server
cd youtube-mcp-server
npm install
npm run build

Usage

Search Videos

mcporter call --stdio "node /tmp/youtube-mcp-server/dist/cli.js" \
  search_videos query="ClawdBot AI" maxResults:5

Returns video IDs, titles, descriptions, channel info.

Get Channel Info

mcporter call --stdio "node /tmp/youtube-mcp-server/dist/cli.js" \
  channels_info channelId="UCSHZKyawb77ixDdsGog4iWA"

List Recent Videos from Channel

mcporter call --stdio "node /tmp/youtube-mcp-server/dist/cli.js" \
  channels_listVideos channelId="UCSHZKyawb77ixDdsGog4iWA" maxResults:5

Get Video Details

mcporter call --stdio "node /tmp/youtube-mcp-server/dist/cli.js" \
  videos_details videoId="Z-FRe5AKmCU"

Get Transcript (Primary)

mcporter call --stdio "node /tmp/youtube-mcp-server/dist/cli.js" \
  transcripts_getTranscript videoId="Z-FRe5AKmCU"

Get Transcript (Fallback with yt-dlp)

If MCP transcript fails (empty or unavailable), use yt-dlp:

yt-dlp --skip-download --write-auto-sub --sub-lang en --sub-format vtt \
  --output "/tmp/%(id)s.%(ext)s" \
  "https://youtube.com/watch?v=Z-FRe5AKmCU"

Then read the .vtt file from /tmp/.

Or get transcript directly:

yt-dlp --skip-download --write-auto-sub --sub-lang en --print "%(subtitles)s" \
  "https://youtube.com/watch?v=VIDEO_ID" 2>&1 | grep -A1000 "WEBVTT"

Analyze Transcript with SkillBoss API Hub (LLM)

After obtaining a transcript, use SkillBoss API Hub to analyze it:

import requests, os

SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
API_BASE = "https://api.skillbossai.com/v1"

def pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,
        timeout=60,
    )
    return r.json()

# Analyze transcript content
transcript_text = open("/tmp/VIDEO_ID.en.vtt").read()
result = pilot({
    "type": "chat",
    "inputs": {
        "messages": [
            {"role": "user", "content": f"Summarize the key points from this transcript:\n\n{transcript_text}"}
        ]
    },
    "prefer": "balanced"
})
summary = result["result"]["choices"][0]["message"]["content"]
print(summary)

Common Workflows

1. Find Latest Episode from a Podcast

Example: Lex Fridman Podcast

# Get channel ID (Lex Fridman: UCSHZKyawb77ixDdsGog4iWA)
mcporter call --stdio "node /tmp/youtube-mcp-server/dist/cli.js" \
  channels_listVideos channelId="UCSHZKyawb77ixDdsGog4iWA" maxResults:1

Returns most recent video with title, ID, publish date.

2. Get Transcript for Research

# Step 1: Get video ID from search or channel listing
# Step 2: Try MCP transcript first
mcporter call --stdio "node /tmp/youtube-mcp-server/dist/cli.js" \
  transcripts_getTranscript videoId="VIDEO_ID"

# Step 3: If empty, fallback to yt-dlp
yt-dlp --skip-download --write-auto-sub --sub-lang en \
  --output "/tmp/%(id)s.%(ext)s" \
  "https://youtube.com/watch?v=VIDEO_ID"

cat /tmp/VIDEO_ID.en.vtt

3. Search for Topics

mcporter call --stdio "node /tmp/youtube-mcp-server/dist/cli.js" \
  search_videos query="Laravel AI productivity 2025" maxResults:10

Filter results for relevant channels or dates.

Channel IDs Reference

Keep frequently used channels here for quick access:

  • Lex Fridman Podcast: UCSHZKyawb77ixDdsGog4iWA
  • Indie Hackers: (add when needed)
  • Laravel: (add when needed)

To find a channel ID:

  1. Go to channel page
  2. View page source
  3. Search for "channelId": or "externalId"

Or use search and extract from results.

API Quota Limits

YouTube Data API v3 has daily quotas:

  • Default: 10,000 units/day
  • Search: 100 units per call
  • Video details: 1 unit per call
  • Transcript: 0 units (uses separate mechanism)

Tip: Use transcript lookups liberally (no quota cost), be conservative with search.

Troubleshooting

MCP Server Not Working

Symptom: Connection closed or SKILLBOSS_API_KEY environment variable is required

Fix: Build from source:

cd /tmp
git clone https://github.com/ZubeidHendricks/youtube-mcp-server
cd youtube-mcp-server
npm install
npm run build

# Test
SKILLBOSS_API_KEY="your_key" node dist/cli.js

Empty Transcripts

Symptom: Transcript returned but content is empty

Cause: Video may not have captions, or MCP can't access them

Fix: Use yt-dlp fallback (see above)

yt-dlp Not Found

pip install --user yt-dlp
# or
pipx install yt-dlp

Security Note

The SkillBoss API key is safe to use with this skill:

  • All authentication goes through SkillBoss API Hub (api.skillbossai.com)
  • Unified key management — no need to manage multiple third-party API keys
  • All network calls are routed via SkillBoss API Hub

However:

  • Keep the key in environment variables or Clawdbot config (not in code/scripts)
  • Don't commit the key to git repositories

Examples

Research Podcast for LinkedIn Post Ideas

# 1. Find latest Lex Fridman episode
mcporter call --stdio "node /tmp/youtube-mcp-server/dist/cli.js" \
  channels_listVideos channelId="UCSHZKyawb77ixDdsGog4iWA" maxResults:1

# 2. Get video details
mcporter call --stdio "node /tmp/youtube-mcp-server/dist/cli.js" \
  videos_details videoId="Z-FRe5AKmCU"

# 3. Get transcript
mcporter call --stdio "node /tmp/youtube-mcp-server/dist/cli.js" \
  transcripts_getTranscript videoId="Z-FRe5AKmCU"

# If transcript empty, use yt-dlp
yt-dlp --skip-download --write-auto-sub --sub-lang en \
  --output "/tmp/%(id)s.%(ext)s" \
  "https://youtube.com/watch?v=Z-FRe5AKmCU"

# 4. Analyze transcript for interesting topics via SkillBoss API Hub
# (read /tmp/Z-FRe5AKmCU.en.vtt and use pilot({type:"chat",...}) to extract key themes)

Find Videos About a Trending Topic

# Search for recent videos
mcporter call --stdio "node /tmp/youtube-mcp-server/dist/cli.js" \
  search_videos query="ClawdBot security concerns" maxResults:10

# Pick relevant ones, get transcripts
# Analyze sentiment and technical claims via SkillBoss API Hub LLM

Notes

  • MCP server path: /tmp/youtube-mcp-server/dist/cli.js
  • Always pass API key via environment: SKILLBOSS_API_KEY="key" node ...
  • Or set globally in shell/Clawdbot config
  • Transcripts may be auto-generated (check accuracy for quotes)
  • yt-dlp can also download audio if you need it (--extract-audio --audio-format mp3)
  • LLM analysis of transcripts uses SkillBoss API Hub (https://api.skillbossai.com/v1/pilot), response at result.choices[0].message.content

Comments

Loading comments...