Youtube Summary Skill

Fetch a YouTube video transcript and provide a structured summary. Usage: /youtube-summary <youtube-url> [--lang <language>]

Security Scan

The skill mostly matches its stated purpose (fetch YouTube transcripts and summarize them), but there are small implementation inconsistencies and a runtime path-execution pattern you should review before installing.

Purpose & Capability

Name/description, included script (fetch_transcript.py), and declared requirement (uv) align with fetching transcripts and producing summaries. One inconsistency: the SKILL.md and README state the default language is English, but the bundled Python script's default --lang is "it,en" (Italian first), which means the script will prefer Italian unless invoked differently. This is a functional mismatch (not evidence of malicious intent) but affects behavior.

Instruction Scope

Runtime instructions are narrow: parse $ARGUMENTS, run a local Python script via 'uv' to fetch transcripts, summarize, and optionally write a Markdown file. The Bash one-liner looks up fetch_transcript.py under the user's Claude plugin cache (~/.claude/plugins/cache/...) and falls back to ~/.claude/skills/; this is necessary for locating the script but means the skill will execute whatever fetch_transcript.py is found in those locations. Review the fetched script before first use. The script itself only uses the youtube-transcript-api and prints JSON; it does not access unrelated files, env vars, or network endpoints beyond the library's normal behavior.

Install Mechanism

This is an instruction-only skill with no install spec and a small included script. It relies on the 'uv' runtime to manage Python dependencies (youtube-transcript-api). There are no downloads from arbitrary URLs or packaged installers in the manifest, so install risk is low. Ensure you trust the source of the skill and the 'uv' tool.

Credentials

The skill requests no environment variables or credentials and does not require access to unrelated service secrets. It does read $ARGUMENTS (the command input) and may write a Markdown file when the user agrees, which is proportional to its purpose.

Persistence & Privilege

always is false and disable-model-invocation is true (it cannot be invoked autonomously), which reduces risk. The skill does not request persistent elevated privileges or modify other skills' configs. It will execute a local script found in plugin/cache or ~/.claude/skills as described—this is normal for skills but you should confirm the script content.

What to consider before installing

The skill appears to do what it says, but review a few things before installing/use: - Verify the bundled fetch_transcript.py content (it is included) to ensure it matches the expected behavior — this skill executes that script directly. The repository copy appears benign (uses youtube-transcript-api and prints JSON) but double-check for any unexpected changes after install. - Note the default-language mismatch: SKILL.md/README say default English, but the script default is "it,en" (Italian preferred). If you expect English by default, pass --lang or edit the script/command. - The runtime command resolves the script from ~/.claude/plugins/cache/... or ~/.claude/skills/ and runs it; ensure those locations are trusted and not modified by other actors on your system. - 'uv' will fetch and run the youtube-transcript-api dependency at runtime; ensure you trust the uv tool and network access for dependency installation. - When prompted to save summaries, the skill will write files locally via the Write tool—be mindful of where files are stored and their contents. If you want higher assurance, run the included fetch_transcript.py locally (outside the skill) against a sample video to confirm behavior and outputs before allowing the skill to execute on your system.

You are tasked with fetching a YouTube video transcript and producing a structured summary.

Steps

1. Parse arguments: Read $ARGUMENTS. Extract the YouTube URL and an optional language flag (--lang <language>). If no URL is provided, use the AskUserQuestion tool to ask the user for it. If no --lang flag is provided, default to English.

2. Fetch the transcript: Run the following command via Bash:

   uv run --no-project --with youtube-transcript-api python -c "import sys,pathlib,runpy; h=pathlib.Path.home(); c=sorted(h.glob('.claude/plugins/cache/youtube-summary-skill/**/fetch_transcript.py')); s=c[-1] if c else h/'.claude/skills/youtube-summary-skill/fetch_transcript.py'; sys.argv=[str(s)]+sys.argv[1:]; runpy.run_path(str(s),run_name='__main__')" "$URL"
   

   Replace $URL with the actual YouTube URL.

3. Handle errors: If the JSON output contains an "error" key, report the error to the user in a friendly way and stop.

4. Summarize: Using the transcript text, produce a structured summary in the chosen language with this format:

   Video Summary

   Overview A brief introductory paragraph summarizing the video's topic and main message.

   Key Points

   • Bullet points covering the main concepts discussed in the video
   • Each point should be concise but informative

   Notable Quotes

   Notable quotes or significant phrases from the video (if any stand out)

   Translate section headings to match the chosen language (e.g., "Panoramica", "Punti chiave", "Citazioni notevoli" for Italian). If the transcript is in a different language than the chosen one, still produce the summary in the chosen language.

5. Offer to save: After presenting the summary, ask the user if they want to save it as a Markdown file. If yes, write it using the Write tool to a reasonable filename based on the video ID (e.g., youtube_summary_<video_id>.md).

Security & Permissions

What this skill does:

• Runs a local Python script via uv to fetch YouTube video transcripts using the youtube-transcript-api library
• Uses YouTube's public transcript/caption data (no API key required)
• Optionally saves the generated summary as a local Markdown file

What this skill does NOT do:

• Does not access your YouTube account or any authenticated data
• Does not upload, post, or modify any content on YouTube
• Does not send data to any third-party service
• Does not store or cache any credentials
• Cannot be invoked autonomously by agents (disable-model-invocation: true)

Bundled scripts: fetch_transcript.py (transcript fetcher)

Dependencies (managed by uv): youtube-transcript-api

Review the script before first use to verify behavior.