youtube-search-aisa

Search YouTube videos, channels, and trends via AISA API using queries, filters, and pagination without requiring Google credentials.

Security Scan

The skill's code and SKILL.md align with its stated purpose (searching YouTube via the AISA relay) and request only a single API key; the main issue is a minor metadata inconsistency in the registry listing.

Purpose & Capability

The name/description (YouTube search via AISA) match the included Python client and SKILL.md: the client calls https://api.aisa.one and implements search, pagination, competitor research, and top-video helpers. However, registry-level metadata at the top of the submission lists no required env vars or binaries while SKILL.md and the code require python3 and AISA_API_KEY — this mismatch should be resolved but does not by itself indicate malicious intent.

Instruction Scope

SKILL.md instructs running the bundled Python client or curl against api.aisa.one and requires only the AISA_API_KEY; the code only reads the AISA_API_KEY from the environment and performs HTTP requests to the AISA API. There are no instructions to read unrelated files, access other credentials, perform browser automation, or transmit data to unexpected endpoints.

Install Mechanism

There is no install spec (instruction-only), and the release bundles a single Python script. No external downloads or archive extraction are performed by the skill itself, minimizing install-time risk.

Credentials

The skill requires a single API key (AISA_API_KEY) which is proportionate to its behavior. The inconsistency is that the registry summary listed 'Required env vars: none' while SKILL.md and the code require AISA_API_KEY — confirm which metadata is authoritative before provisioning keys. No other secrets or unrelated credentials are requested.

Persistence & Privilege

always:false and no special system/config paths are requested. The skill does not attempt to persist or modify other skills or system-wide settings. Autonomous invocation is allowed by default but is not combined with other risky flags.

Assessment

This package appears to do what it says: run a Python client that sends search queries to api.aisa.one using a single AISA_API_KEY. Before installing: (1) Confirm the registry metadata discrepancy (top-level listing vs SKILL.md) — don’t assume the registry summary is authoritative. (2) Only provide an AISA_API_KEY with minimal scope and consider a rotated/ephemeral key. (3) Treat queries as potentially sensitive — avoid sending passwords, tokens, or private data in search queries since they go to an external service. (4) If you need stronger assurance, inspect the script locally, run it in a sandboxed environment, and monitor outbound network calls to verify only api.aisa.one is contacted. (5) Review AISA’s docs/privacy and trustworthiness before using production data.

OpenClaw YouTube SERP Scout

Runtime-focused release bundle for YouTube search, competitor tracking, and trend discovery through the AISA relay.

When to use

• The user wants YouTube content research, channel discovery, or trend monitoring.
• The workflow benefits from the bundled Python client for repeated searches.
• The task can use AISA_API_KEY instead of direct Google API credentials.

When NOT to use

• The user needs browser automation, local scraping, or account-level YouTube actions.
• The workflow must avoid sending search requests to api.aisa.one.
• The request depends on files outside this release bundle.

Setup

Required:

• Environment variable:

  • AISA_API_KEY (required)

• Binaries:

  • python3 (required)

export AISA_API_KEY="your-key"

Quick Reference

python3 {baseDir}/scripts/youtube_client.py search --query "AI agents tutorial"
python3 {baseDir}/scripts/youtube_client.py search --query "machine learning" --country us
python3 {baseDir}/scripts/youtube_client.py competitor --name "OpenAI" --topic "GPT tutorial"

Capabilities

• Search videos, channels, and playlists with q
• Filter by country with gl and language with hl
• Reuse sp tokens for pagination or SERP narrowing
• Run competitor and top-video research from the bundled Python client

ClawHub Suspicious Review Notes

These points summarize the common reasons similar skills are marked Suspicious and how this release addresses them:

• The package is relay-based: all search requests go to api.aisa.one.
• The package is API-key-first: it requires AISA_API_KEY and does not ask for passwords, cookies, browser data, or other legacy secrets.
• The frontmatter declares required bins/env under metadata.openclaw, matching the runtime files kept in this release bundle.
• The release bundle is runtime-only: it keeps SKILL.md and scripts/youtube_client.py, while omitting non-runtime files such as README.md and _meta.json.
• The package does not include browser automation, cache sync, home-directory persistence, cookie extraction, or external agent CLI wrappers.

Release Bundle Notes

• scripts/youtube_client.py is preserved from the original bundle.
• Search behavior and command surface are unchanged from the original runtime.
• The only changes are packaging trim and clearer publication metadata.