Youtube Performance
v1.0.0Track YouTube channel performance and analytics. Use when the user says 'YouTube analytics', 'YouTube metrics', 'how is my YouTube doing', 'video views', 'wa...
⭐ 0· 55·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill advertises YouTube analytics and only requires an MCP Connector link (an embedded auth token) to fetch metrics from the Boring service. No unrelated environment variables, binaries, or installs are requested, which is proportionate to the stated purpose.
Instruction Scope
SKILL.md limits runtime actions to calling Boring API helpers (boring_get_performance, boring_get_video_analytics, etc.) and formatting results. It does not instruct reading local files or unrelated credentials. However, the instructions depend entirely on the external MCP link and the Boring platform; the skill asserts the token is read‑only and that no local secrets are used, but those claims cannot be independently verified from the instructions alone.
Install Mechanism
Instruction-only skill with no install spec and no code files. This minimizes on-disk persistence and installation risk.
Credentials
No environment variables are requested, but the skill requires an MCP connector link which embeds an auth token. That connector functions as the single credential and is proportionate to an analytics integration. Because the token is embedded in a URL, it is sensitive; the SKILL.md claims read-only scope and server-side storage, but those are third‑party assurances you should verify before sharing the link.
Persistence & Privilege
The skill is not marked always:true and follows the platform default (agent-invocable/autonomous allowed). This is normal and not problematic here, given the limited scope and single credential requirement.
Assessment
This skill appears coherent: it uses a single MCP connector link (an embedded auth token) to fetch YouTube metrics from the Boring service. Before installing, confirm you trust boring.aiagent-me.com and the listed homepage/repo, because the connector URL is effectively a password and will grant the skill read access to your analytics. Ask the maintainer to document exact token scopes and retention, and verify you can revoke/regenerate the token. If you prefer tighter control, consider using an integration that performs OAuth directly with Google/YouTube or inspect Boring's privacy/security docs and source code before adding the connector. Finally, avoid pasting the MCP link in any public or untrusted channels.Like a lobster shell, security has layers — review code before you run it.
latestvk97c8dgezgnyyb86r3c68aksch83sj1v
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📊 Clawdis
ConfigMCP Connector link from boring.aiagent-me.com (contains embedded auth token)