Youtube Downloader
v1.0.1Download YouTube videos as MP4 at highest quality. Use when user sends a YouTube URL and wants to download/save it. Triggers on YouTube links (youtube.com, y...
⭐ 0· 565·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's stated purpose (download YouTube videos) matches the bundled script which calls yt-dlp to fetch and save videos. However, the registry metadata and SKILL.md declare no required binaries or credentials, while the script actually depends on external tools (yt-dlp and optionally jq). Omitting those required binaries in the manifest is an inconsistency that could lead to failed runs or surprise behavior.
Instruction Scope
The SKILL.md and script are narrowly scoped to take a URL and optional label, run yt-dlp, save the MP4 to ~/.openclaw/workspace/assets/videos, and update a registry. That stays within the stated purpose. One minor mismatch: SKILL.md mentions age-restricted videos may need cookies, but the script has no way to accept cookie files or credentials — so the documentation overpromises a capability that isn't implemented.
Install Mechanism
There is no install spec (instruction-only + included script). No remote downloads or installers are invoked by the skill itself. The main install-related risk is that yt-dlp (an external dependency) must be present and may be installed by the user; the skill does not fetch arbitrary remote code.
Credentials
The skill requests no environment variables, credentials, or config paths. The script only reads the provided URL/label and writes files under the agent workspace (~/.openclaw/workspace/assets), which is consistent with its purpose.
Persistence & Privilege
The skill is not marked always:true and is user-invocable. It writes assets/registry files only under the skill's workspace path and does not modify other skills or system-wide configuration. Autonomous invocation is allowed by default but not set to forced inclusion.
What to consider before installing
This skill is largely coherent: it includes a Bash script that uses yt-dlp to download videos and save them under ~/.openclaw/workspace/assets/videos and updates a local registry. Before installing: 1) Ensure you have yt-dlp installed from a trusted source (and jq if you want registry updates). The manifest did not declare these dependencies. 2) Review and confirm you're comfortable with the skill writing files to ~/.openclaw/workspace/assets and running the bundled script. 3) If you need to download age-restricted videos, update the script to accept a cookies file or credentials — the current script documents this limitation but doesn't implement cookie handling. 4) Consider legal and ToS implications for downloading YouTube content. 5) If you want stricter control, restrict the skill from autonomous invocation or run it in an isolated environment first. If you want higher assurance, request the author add required-binary metadata (yt-dlp, jq) and an explicit mechanism for cookies or authentication.Like a lobster shell, security has layers — review code before you run it.
latestvk97a2cjt2f5h566jvwcf5f3c1h81sy07
License
MIT-0
Free to use, modify, and redistribute. No attribution required.