Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Youtube Summary Skill

v1.0.7

Fetch a YouTube video transcript and provide a structured summary. Usage: /youtube-summary <youtube-url> [--lang <language>]

0· 195·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ivanopassari/youtube-summary-skill.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Youtube Summary Skill" (ivanopassari/youtube-summary-skill) from ClawHub.
Skill page: https://clawhub.ai/ivanopassari/youtube-summary-skill
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: uv
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install youtube-summary-skill

ClawHub CLI

Package manager switcher

npx clawhub@latest install youtube-summary-skill
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description, included script (fetch_transcript.py), and declared requirement (uv) align with fetching transcripts and producing summaries. One inconsistency: the SKILL.md and README state the default language is English, but the bundled Python script's default --lang is "it,en" (Italian first), which means the script will prefer Italian unless invoked differently. This is a functional mismatch (not evidence of malicious intent) but affects behavior.
Instruction Scope
Runtime instructions are narrow: parse $ARGUMENTS, run a local Python script via 'uv' to fetch transcripts, summarize, and optionally write a Markdown file. The Bash one-liner looks up fetch_transcript.py under the user's Claude plugin cache (~/.claude/plugins/cache/...) and falls back to ~/.claude/skills/; this is necessary for locating the script but means the skill will execute whatever fetch_transcript.py is found in those locations. Review the fetched script before first use. The script itself only uses the youtube-transcript-api and prints JSON; it does not access unrelated files, env vars, or network endpoints beyond the library's normal behavior.
Install Mechanism
This is an instruction-only skill with no install spec and a small included script. It relies on the 'uv' runtime to manage Python dependencies (youtube-transcript-api). There are no downloads from arbitrary URLs or packaged installers in the manifest, so install risk is low. Ensure you trust the source of the skill and the 'uv' tool.
Credentials
The skill requests no environment variables or credentials and does not require access to unrelated service secrets. It does read $ARGUMENTS (the command input) and may write a Markdown file when the user agrees, which is proportional to its purpose.
Persistence & Privilege
always is false and disable-model-invocation is true (it cannot be invoked autonomously), which reduces risk. The skill does not request persistent elevated privileges or modify other skills' configs. It will execute a local script found in plugin/cache or ~/.claude/skills as described—this is normal for skills but you should confirm the script content.
What to consider before installing
The skill appears to do what it says, but review a few things before installing/use: - Verify the bundled fetch_transcript.py content (it is included) to ensure it matches the expected behavior — this skill executes that script directly. The repository copy appears benign (uses youtube-transcript-api and prints JSON) but double-check for any unexpected changes after install. - Note the default-language mismatch: SKILL.md/README say default English, but the script default is "it,en" (Italian preferred). If you expect English by default, pass --lang or edit the script/command. - The runtime command resolves the script from ~/.claude/plugins/cache/... or ~/.claude/skills/ and runs it; ensure those locations are trusted and not modified by other actors on your system. - 'uv' will fetch and run the youtube-transcript-api dependency at runtime; ensure you trust the uv tool and network access for dependency installation. - When prompted to save summaries, the skill will write files locally via the Write tool—be mindful of where files are stored and their contents. If you want higher assurance, run the included fetch_transcript.py locally (outside the skill) against a sample video to confirm behavior and outputs before allowing the skill to execute on your system.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎬 Clawdis
Binsuv
latestvk97axzf8htzhwmjr6r9xe0pmg983h40w
195downloads
0stars
9versions
Updated 1mo ago
v1.0.7
MIT-0

YouTube Summary Skill

You are tasked with fetching a YouTube video transcript and producing a structured summary.

Steps

  1. Parse arguments: Read $ARGUMENTS. Extract the YouTube URL and an optional language flag (--lang <language>). If no URL is provided, use the AskUserQuestion tool to ask the user for it. If no --lang flag is provided, default to English.

  2. Fetch the transcript: Run the following command via Bash:

    uv run --no-project --with youtube-transcript-api python -c "import sys,pathlib,runpy; h=pathlib.Path.home(); c=sorted(h.glob('.claude/plugins/cache/youtube-summary-skill/**/fetch_transcript.py')); s=c[-1] if c else h/'.claude/skills/youtube-summary-skill/fetch_transcript.py'; sys.argv=[str(s)]+sys.argv[1:]; runpy.run_path(str(s),run_name='__main__')" "$URL"
    

    Replace $URL with the actual YouTube URL.

  3. Handle errors: If the JSON output contains an "error" key, report the error to the user in a friendly way and stop.

  4. Summarize: Using the transcript text, produce a structured summary in the chosen language with this format:

    Video Summary

    Overview A brief introductory paragraph summarizing the video's topic and main message.

    Key Points

    • Bullet points covering the main concepts discussed in the video
    • Each point should be concise but informative

    Notable Quotes

    Notable quotes or significant phrases from the video (if any stand out)

    Translate section headings to match the chosen language (e.g., "Panoramica", "Punti chiave", "Citazioni notevoli" for Italian). If the transcript is in a different language than the chosen one, still produce the summary in the chosen language.

  5. Offer to save: After presenting the summary, ask the user if they want to save it as a Markdown file. If yes, write it using the Write tool to a reasonable filename based on the video ID (e.g., youtube_summary_<video_id>.md).

Security & Permissions

What this skill does:

  • Runs a local Python script via uv to fetch YouTube video transcripts using the youtube-transcript-api library
  • Uses YouTube's public transcript/caption data (no API key required)
  • Optionally saves the generated summary as a local Markdown file

What this skill does NOT do:

  • Does not access your YouTube account or any authenticated data
  • Does not upload, post, or modify any content on YouTube
  • Does not send data to any third-party service
  • Does not store or cache any credentials
  • Cannot be invoked autonomously by agents (disable-model-invocation: true)

Bundled scripts: fetch_transcript.py (transcript fetcher)

Dependencies (managed by uv): youtube-transcript-api

Review the script before first use to verify behavior.

Comments

Loading comments...