YouTube Music

Manage YouTube Music library, playlists, and discovery via ytmusicapi.

Security Scan

Instructions and requirements are coherent for a ytmusicapi-based YouTube Music librarian; the only noteworthy risk is that the setup requires creating and storing browser auth headers (browser.json), which are sensitive and should be handled carefully.

Purpose & Capability

Name/description match the instructions: the SKILL.md instructs using the ytmusicapi Python library to manage YouTube Music and playlist/library operations. No unrelated binaries, env vars, or services are requested.

Instruction Scope

Instructions stay within the stated purpose (install ytmusicapi, create browser.json via copied network request, use API calls). However the auth-generation steps require copying browser request headers (containing session cookies/tokens) into headers.txt and converting them to browser.json; that produces sensitive credentials which the skill will store in the skill folder.

Install Mechanism

No install spec in the manifest; SKILL.md recommends 'pip install ytmusicapi', which is an expected and proportionate mechanism. No downloads from untrusted URLs or archive extraction are instructed.

Credentials

The skill requests no environment variables or unrelated credentials. The implicit requirement to create and store browser.json grants the skill the same API access as the logged-in YouTube Music account — appropriate for the feature set but high-value, so treat the file as a secret.

Persistence & Privilege

always is false and model invocation is allowed (the platform default). The skill does not request permanent platform-level privileges or modify other skills' configs.

Assessment

This skill is internally consistent for controlling YouTube Music via ytmusicapi, but its setup requires you to extract browser request headers and create a browser.json file that contains your account authentication data. Before installing: (1) verify the ytmusicapi package source (use a virtualenv and inspect PyPI/GitHub for the package), (2) store browser.json in a safe location and delete it when not needed, (3) consider creating/using a secondary Google account if you want to limit blast radius, (4) never paste headers into untrusted machines or public paste sites, and (5) only grant file-system or skill-level access to this skill/agent if you trust the runtime environment. If you want a less sensitive option, look for an OAuth-based flow or official API methods instead of copying browser headers.

YTMusic Librarian

This skill uses the ytmusicapi Python library to interact with YouTube Music.

Prerequisites

• Python 3.x
• ytmusicapi package: pip install ytmusicapi
• Authentication file (oauth.json or browser.json) in the skill folder.

Setup Instructions

1. Install the library:

   pip install ytmusicapi
   

2. Generate Authentication (The "cURL Handshake"):

   • Open Microsoft Edge and visit music.youtube.com (ensure you are logged in).
   • Press F12 to open DevTools, go to the Network tab.
   • Click your Profile Icon -> Library on the page.
   • Look for a request named browse in the network list.
   • Right-click the browse request -> Copy -> Copy as cURL (bash).
   • Paste that cURL command into a file named headers.txt in the skill folder.
   • Run the following Python snippet to generate browser.json:

     from ytmusicapi.auth.browser import setup_browser
     with open('headers.txt', 'r') as f:
         setup_browser('browser.json', f.read())
     

   • Ensure browser.json is located in the skill folder.

3. Verify:

   python -c "from ytmusicapi import YTMusic; yt = YTMusic('browser.json'); print(yt.get_library_songs(limit=1))"
   

Workflows

Library Management

• List songs/albums: yt.get_library_songs(), yt.get_library_albums()
• Add/Remove: yt.rate_song(videoId, 'LIKE'), yt.edit_song_library_status(feedbackToken)

Playlist Management

• Create: yt.create_playlist(title, description)
• Add Tracks: yt.add_playlist_items(playlistId, [videoIds])
• Remove Tracks: yt.remove_playlist_items(playlistId, [videoIds])

Metadata & Discovery

• Get Lyrics: yt.get_lyrics(browseId)
• Get Related: yt.get_watch_playlist(videoId) -> related