YouTube Live Broadcast Checking

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: youtube-live-broadcast-checking Version: 1.3.7 The skill is a legitimate integration for monitoring YouTube live streams and upcoming broadcasts using the official Google Data API v3. The code in skill.js and store.js implements the described functionality (watchlist management and API querying) without any signs of malicious intent, data exfiltration, or unauthorized command execution. It correctly handles the YOUTUBE_API_KEY environment variable and persists user-defined channel lists to a local watchlist.json file as documented.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

A misconfigured or over-broad API key could consume quota or expose access to the associated Google Cloud project's YouTube Data API allowance.

Why it was flagged

The skill reads a Google/YouTube API key from the agent environment and uses it to authenticate YouTube Data API calls.

Skill content

return process.env.YOUTUBE_API_KEY;

Recommendation

Use a restricted API key limited to the YouTube Data API, avoid sharing it with unrelated skills, and monitor quota usage in Google Cloud.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill may fetch third-party Node dependencies, so dependency integrity depends on npm/package-lock behavior and the user's install process.

Why it was flagged

The skill depends on an npm package to call Google APIs. This is expected for the purpose, but npm installation introduces normal third-party dependency provenance considerations.

Skill content

"dependencies": { "googleapis": "^126.0.0" }

Recommendation

Install from the referenced repository or trusted package source, review the lockfile when possible, and keep dependencies updated.

Note

ASI06: Memory and Context Poisoning

What this means

The local watchlist can reveal which channels the user monitors and will remain available to future agent sessions using this skill.

Why it was flagged

The skill stores the user's channel watchlist on disk so it persists across agent restarts.

Skill content

const STORAGE_FILE = path.join(__dirname, 'watchlist.json');

Recommendation

Only add channels you are comfortable storing locally, and delete watchlist.json or use the remove tool if you no longer want entries retained.