Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Youtube Channels

v1.4.1

Work with YouTube channels — resolve handles to IDs, browse uploads, get latest videos, search within channels. Use when the user asks about a specific channel, wants to see recent uploads, or says "what has X posted lately", "latest from TED", "show me their channel", "list channel videos", "browse channel uploads".

0· 3k·3 current·3 all-time
byRohit Das@therohitdas
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description, required env (TRANSCRIPT_API_KEY), and required binary (node) all match a small client for TranscriptAPI.com YouTube endpoints. Declared config path (~/.openclaw/openclaw.json) is used to store the API key so the skill can run — this is coherent for the stated purpose.
Instruction Scope
SKILL.md instructs using the provided CLI script for passwordless account setup, and using the TranscriptAPI endpoints via curl. The runtime instructions only reference the declared config path and the API service; they do not ask the agent to read unrelated files or exfiltrate other credentials.
Install Mechanism
No install spec is provided (instruction-only); a single included Node script is present and intended to be executed locally. There are no downloads or archive extracts from untrusted URLs in the skill package itself.
Credentials
Only TRANSCRIPT_API_KEY is required and is the primary credential; the skill does not request additional unrelated secrets. The CLI asks for an email/OTP during registration but those are part of the auth flow, not hidden credential requests.
Persistence & Privilege
always is false and the skill does not request elevated or cross-skill config changes. The script writes the API key into its own declared OpenClaw config path and backs up the existing file, which is a reasonable self-configuration step for runtime use.
Assessment
This skill appears to do what it says: it uses TranscriptAPI to resolve channels and list videos and requires a single API key. Before installing/run the CLI: (1) review and be comfortable with writing your API key to ~/.openclaw/openclaw.json (the script backs up the file to .bak), (2) ensure you trust transcriptapi.com and create the API key via their site if you prefer not to run the bundled script, (3) note the script requires node and will reject disposable email addresses during register, and (4) if you prefer manual control, you can set TRANSCRIPT_API_KEY in your shell profile instead of using the save-to-config flow. Overall the package is internally consistent; proceed if you trust the TranscriptAPI service and are okay with the OpenClaw config change.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📡 Clawdis
Binsnode
EnvTRANSCRIPT_API_KEY
Config~/.openclaw/openclaw.json
Primary envTRANSCRIPT_API_KEY
latestvk972kxj24v5kwr47pz1p0psd3d80yezv
3kdownloads
0stars
12versions
Updated 2m ago
v1.4.1
MIT-0

YouTube Channels

YouTube channel tools via TranscriptAPI.com.

Setup

If $TRANSCRIPT_API_KEY is not set, help the user create an account (100 free credits, no card):

Step 1 — Register: Ask user for their email.

node ./scripts/tapi-auth.js register --email USER_EMAIL

→ OTP sent to email. Ask user: "Check your email for a 6-digit verification code."

Step 2 — Verify: Once user provides the OTP:

node ./scripts/tapi-auth.js verify --token TOKEN_FROM_STEP_1 --otp CODE

API key saved to ~/.openclaw/openclaw.json. See File Writes below for details. Existing file is backed up before modification.

Manual option: transcriptapi.com/signup → Dashboard → API Keys.

File Writes

The verify and save-key commands save the API key to ~/.openclaw/openclaw.json (sets skills.entries.transcriptapi.apiKey and enabled: true). Existing file is backed up to ~/.openclaw/openclaw.json.bak before modification.

To use the API key in terminal/CLI outside the agent, add to your shell profile manually: export TRANSCRIPT_API_KEY=<your-key>

API Reference

Full OpenAPI spec: transcriptapi.com/openapi.json — consult this for the latest parameters and schemas.

All channel endpoints accept flexible input — @handle, channel URL, or UC... channel ID. No need to resolve first.

GET /api/v2/youtube/channel/resolve — FREE

Convert @handle, URL, or UC... ID to canonical channel ID.

curl -s "https://transcriptapi.com/api/v2/youtube/channel/resolve?input=@TED" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"
ParamRequiredValidation
inputyes1-200 chars — @handle, URL, or UC... ID

Response:

{ "channel_id": "UCsT0YIqwnpJCM-mx7-gSA4Q", "resolved_from": "@TED" }

If input is already UC[a-zA-Z0-9_-]{22}, returns immediately.

GET /api/v2/youtube/channel/latest — FREE

Latest 15 videos via RSS with exact stats.

curl -s "https://transcriptapi.com/api/v2/youtube/channel/latest?channel=@TED" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"
ParamRequiredValidation
channelyes@handle, channel URL, or UC... ID

Response:

{
  "channel": {
    "channelId": "UCsT0YIqwnpJCM-mx7-gSA4Q",
    "title": "TED",
    "author": "TED",
    "url": "https://www.youtube.com/channel/UCsT0YIqwnpJCM-mx7-gSA4Q",
    "published": "2006-04-17T00:00:00Z"
  },
  "results": [
    {
      "videoId": "abc123xyz00",
      "title": "Latest Video Title",
      "channelId": "UCsT0YIqwnpJCM-mx7-gSA4Q",
      "author": "TED",
      "published": "2026-01-30T16:00:00Z",
      "updated": "2026-01-31T02:00:00Z",
      "link": "https://www.youtube.com/watch?v=abc123xyz00",
      "description": "Full video description...",
      "thumbnail": { "url": "https://i1.ytimg.com/vi/.../hqdefault.jpg" },
      "viewCount": "2287630",
      "starRating": {
        "average": "4.92",
        "count": "15000",
        "min": "1",
        "max": "5"
      }
    }
  ],
  "result_count": 15
}

Great for monitoring channels — free and gives exact view counts + ISO timestamps.

GET /api/v2/youtube/channel/videos — 1 credit/page

Paginated list of ALL channel uploads (100 per page).

# First page
curl -s "https://transcriptapi.com/api/v2/youtube/channel/videos?channel=@NASA" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"

# Next pages
curl -s "https://transcriptapi.com/api/v2/youtube/channel/videos?continuation=TOKEN" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"
ParamRequiredValidation
channelconditional@handle, channel URL, or UC... ID
continuationconditionalnon-empty (next pages)

Provide exactly one of channel or continuation, not both.

Response:

{
  "results": [{
    "videoId": "abc123xyz00",
    "title": "Video Title",
    "channelId": "UCsT0YIqwnpJCM-mx7-gSA4Q",
    "channelTitle": "TED",
    "channelHandle": "@TED",
    "lengthText": "15:22",
    "viewCountText": "3.2M views",
    "thumbnails": [...],
    "index": "0"
  }],
  "playlist_info": {"title": "Uploads from TED", "numVideos": "5000", "ownerName": "TED"},
  "continuation_token": "4qmFsgKlARIYVVV1...",
  "has_more": true
}

Keep calling with continuation until has_more: false.

GET /api/v2/youtube/channel/search — 1 credit

Search within a specific channel.

curl -s "https://transcriptapi.com/api/v2/youtube/channel/search\
?channel=@TED&q=climate+change&limit=30" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"
ParamRequiredValidation
channelyes@handle, channel URL, or UC... ID
qyes1-200 chars
limitno1-50 (default 30)

Typical workflow

# 1. Check latest uploads (free — pass @handle directly)
curl -s "https://transcriptapi.com/api/v2/youtube/channel/latest?channel=@TED" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"

# 2. Get transcript of recent video
curl -s "https://transcriptapi.com/api/v2/youtube/transcript\
?video_url=VIDEO_ID&format=text&include_timestamp=true&send_metadata=true" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"

Errors

CodeAction
400Invalid param combination (both or neither channel/continuation)
402No credits — transcriptapi.com/billing
404Channel not found
408Timeout — retry once
422Invalid channel identifier

Free tier: 100 credits, 300 req/min. Free endpoints (resolve, latest) require auth but don't consume credits.

Comments

Loading comments...