YouTube Live Broadcast Checking
v1.3.5Check and manage YouTube channels to find their next scheduled live broadcasts using the YouTube Data API v3 and a Google API key.
⭐ 0· 158·0 current·0 all-time
bySteven Ho@stevenho1394
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name/description match the implementation: it calls the YouTube Data API (googleapis) and exposes watchlist and query tools. The only inconsistency is registry-summary metadata presented at the top of the evaluation (which claimed no required env vars) versus the package manifests and SKILL.md which correctly require YOUTUBE_API_KEY. Requiring an API key is proportionate to the stated purpose.
Instruction Scope
SKILL.md and the code confine runtime actions to resolving channel identifiers, calling YouTube Data API endpoints (search, channels.list, videos.list) and maintaining an in-memory watchlist. The instructions do not ask the agent to read unrelated files or environment variables beyond YOUTUBE_API_KEY. Note: resolving display names/handles uses YouTube search which can produce noisy matches and consumes API quota (documented).
Install Mechanism
Installation is via npm (package.json / clawhub.json indicate 'npm install' to fetch googleapis and its dependencies). This is expected for a Node.js skill but carries the usual supply-chain considerations of installing third-party npm packages; no direct downloads from personal servers or URL-shorteners are used.
Credentials
Only YOUTUBE_API_KEY is required by the code (config.js reads process.env.YOUTUBE_API_KEY). That is proportionate. However, the top-level registry 'Requirements' block incorrectly reported no required env vars — verify the agent's configuration will supply the API key and that no other secrets are being requested at runtime.
Persistence & Privilege
The skill does not request always: true, does not persist data to disk by default (store.js is in-memory), and does not modify other skills or system configuration. Its privilege surface is limited to making outbound calls to YouTube APIs using the provided API key.
Assessment
This skill appears to do what it says: it uses the googleapis library and requires a YOUTUBE_API_KEY to call YouTube Data API v3. Before installing: (1) Confirm you will provide a valid YOUTUBE_API_KEY (the registry summary in the UI appears inconsistent—the package and SKILL.md do require it). (2) Be aware API calls consume your YouTube quota; the skill performs search/list/video queries when resolving names. (3) Installing requires npm install—review package-lock.json and trust the googleapis dependency from npm (standard but subject to supply-chain risk). (4) The watchlist is in-memory only; if you need persistence expect to modify the skill. If you need higher assurance, verify the full repository at the declared GitHub URL and inspect the complete skill.js (the provided snippet was truncated in the listing but the code reviewed shows no obfuscated behavior).Like a lobster shell, security has layers — review code before you run it.
latestvk971hqv00709txn5nytr0y9b8983618n
License
MIT-0
Free to use, modify, and redistribute. No attribution required.