Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

YouTube Video Downloader

v1.0.4

Download YouTube videos by URL in various resolutions using a pay-per-use API with credit-based authentication and no charge on failed downloads. Use when us...

0· 171·0 current·0 all-time
bylordest@jxyyjm

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jxyyjm/youtube-downloader-skill.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "YouTube Video Downloader" (jxyyjm/youtube-downloader-skill) from ClawHub.
Skill page: https://clawhub.ai/jxyyjm/youtube-downloader-skill
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install youtube-downloader-skill

ClawHub CLI

Package manager switcher

npx clawhub@latest install youtube-downloader-skill
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description and SKILL.md consistently describe a pay-per-use API for downloading YouTube videos; the endpoints, request/response examples, and usage examples all align with that purpose. However, the package metadata declares no required credentials or homepage/source while the runtime instructions explicitly require an API key from a third‑party host (https://skill.lordest.cn), creating an omission/inconsistency between claimed metadata and actual operation.
Instruction Scope
The SKILL.md only instructs the agent to call a single external API (skill.lordest.cn) and shows curl/Python examples. It does not instruct reading local files, scanning system state, or contacting additional unexpected endpoints. The only data the skill needs from the user is an API key and the requested YouTube URL/resolution.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing is written to disk by the skill itself. That minimizes code-execution risk, but the skill routes network requests to an external service.
!
Credentials
Although metadata lists no required environment variables or primary credential, the SKILL.md explicitly requires an API key (format sk-yt-xxxxx) obtained from https://skill.lordest.cn. That API key requirement is not declared in the registry metadata — a mismatch that obscures the true credential needs. Requesting a user-provided API key is reasonable for a pay-per-use service, but you should verify who stores/uses that key, how OpenClaw will persist it, and whether the service's billing/privacy terms are acceptable.
Persistence & Privilege
The skill is not marked always:true and does not request system-wide configuration changes. Autonomous model invocation is allowed by platform default, but there is no additional persistent privilege requested in the skill package itself.
What to consider before installing
This skill appears to be what it says (an API-backed YouTube downloader) but it has important gaps: the SKILL.md requires an API key from skill.lordest.cn but the registry metadata does not declare that credential or provide a homepage/source. Before installing, confirm: (1) who runs skill.lordest.cn and whether you trust that operator, (2) the service's privacy, billing, and retention policy for uploaded or processed videos and stored API keys, (3) how OpenClaw will store the API key (transient prompt vs persistent environment variable), and (4) whether you can review the service's source code or a trustworthy homepage. If you cannot verify those things, prefer alternatives that run locally (e.g., yt-dlp) or come from a verifiable vendor. If you proceed, avoid using high-privilege or reusable secrets and monitor billing/usage closely.

Like a lobster shell, security has layers — review code before you run it.

latestvk97199yks7fjcb7h50y8kmxj1983pt0b
171downloads
0stars
5versions
Updated 1mo ago
v1.0.4
MIT-0

YouTube Video Downloader Skill

Download any YouTube video in various resolutions with a simple command. Supports 360p, 480p, 720p, 1080p, best quality, and audio-only extraction.

Quick Install

Just tell OpenClaw:

"Help me install this skill: https://clawhub.ai/jxyyjm/youtube-downloader-skill"

OpenClaw will ask you for an API Key. Follow these steps to get one:

That's it! You're ready to use the skill.

Usage

Once installed, just tell OpenClaw what you want. For example:

"Download this YouTube video: https://youtube.com/watch?v=dQw4w9WgXcQ"

"Download this video in 1080p: https://youtube.com/watch?v=xxxxx"

"Extract audio from this video: https://youtube.com/watch?v=xxxxx"

Supported resolutions: 360p, 480p, 720p (default), 1080p, best, audio-only.

Authentication

All API calls require an API Key in the Authorization header:

Authorization: Bearer sk-yt-xxxxx

Get your API Key at: https://skill.lordest.cn/?page=apikeys

Endpoints

POST /api/v1/download

Download a YouTube video.

Request:

{
  "youtube_url": "https://www.youtube.com/watch?v=dQw4w9WgXcQ",
  "resolution": "720"
}

Parameters:

  • youtube_url (required): YouTube video URL
  • resolution (optional): "360", "480", "720", "1080", "best", "audio". Default: "720"

Response (success):

{
  "success": true,
  "download_url": "https://oss-bucket.aliyuncs.com/skill/abc123/video.mp4",
  "video_title": "Video Title",
  "video_duration": 212,
  "file_size": 52428800,
  "resolution": "720",
  "processing_time": 45.2
}

GET /api/v1/balance

Check account status.

Response:

{
  "username": "user123"
}

GET /health

Health check (no authentication required).

Response:

{
  "status": "healthy",
  "service": "YouTube Video Downloader Service",
  "version": "1.0.0"
}

Error Codes

CodeMeaning
200Success
401Invalid or missing API Key
400Invalid request (bad URL, etc.)
500Server error

Example (curl)

# Download a video
curl -X POST https://skill.lordest.cn/api/v1/download \
  -H "Authorization: Bearer sk-yt-xxxxx" \
  -H "Content-Type: application/json" \
  -d '{"youtube_url": "https://youtube.com/watch?v=dQw4w9WgXcQ", "resolution": "720"}'

Example (Python)

import requests

API_KEY = "sk-yt-xxxxx"
BASE_URL = "https://skill.lordest.cn"

# Download
resp = requests.post(
    f"{BASE_URL}/api/v1/download",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={"youtube_url": "https://youtube.com/watch?v=dQw4w9WgXcQ", "resolution": "720"}
)
data = resp.json()
if data["success"]:
    print(f"Download URL: {data['download_url']}")

Comments

Loading comments...