Youtube Master
v1.0.2Get YouTube video info, statistics, descriptions, thumbnails, and optionally transcripts. Uses YouTube Data API (free) for basic info and Apify (optional) fo...
⭐ 2· 424·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The functionality (YouTube Data API for metadata; Apify for transcripts) is coherent with the skill name and description. However, the registry lists both YOUTUBE_API_KEY and APIFY_TOKEN as required env vars while SKILL.md describes Apify as "optional" for transcripts — this mismatch is disproportionate to the stated optional nature of transcripts.
Instruction Scope
SKILL.md tells users two credential setup options: environment variables or a credentials file at ~/.openclaw/workspace/credentials/api-credentials.json. The Python script, however, only reads the credentials file (get_credentials() reads that JSON file) and does not read environment variables at all. That divergence between instructions and runtime behavior is a functional security/usability problem: users may supply env vars expecting the skill to use them, but the script will ignore them.
Install Mechanism
This is an instruction-only skill with a small included Python script and no install spec or downloaded artifacts. No installer URLs or archive extraction are involved.
Credentials
Requesting YOUTUBE_API_KEY and APIFY_TOKEN conceptually fits the functionality, but APIFY_TOKEN is effectively optional (used only when transcripts are requested) while the registry metadata lists it as required. Additionally, the SKILL.md suggests env var usage but the script ignores env vars; this mismatch could cause users to expose credentials in the wrong place or believe the skill is more privileged than it is. The script will read credentials from a specific path under the user's home directory, which is consistent with the documentation but should be documented clearly.
Persistence & Privilege
The skill does not request permanent/always presence, does not modify other skills or system-wide settings, and only makes outbound API calls to Google and Apify when invoked (Apify only on explicit transcript request).
What to consider before installing
This skill appears to implement the described functionality, but there are important inconsistencies you should resolve before installing:
- The registry claims both YOUTUBE_API_KEY and APIFY_TOKEN are required, but transcripts are optional. Confirm whether APIFY_TOKEN should be optional and update the registry metadata accordingly.
- SKILL.md documents two credential options (env vars OR a credentials file), but the script only reads the credentials file (~/.openclaw/workspace/credentials/api-credentials.json). If you plan to use environment variables, ask the author to fix the code or use the credentials file instead.
- The script calls a specific Apify actor (scrape-creators~best-youtube-transcripts-scraper) when fetching transcripts. If you will supply an APIFY_TOKEN, review the actor's privacy/behavior (on apify.com) and ensure the token has the minimal necessary permissions. Only provide APIFY_TOKEN if you need transcripts.
- Store API keys carefully (use the credentials file or a secrets manager); do not paste them into public places. Consider testing the script in a controlled environment first.
If the author cannot clarify/fix the env vs file behavior, treat the mismatch as a red flag and prefer not to install until corrected.Like a lobster shell, security has layers — review code before you run it.
latestvk97a3wj5wt0r466vsqd05nm765820gr0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvYOUTUBE_API_KEY, APIFY_TOKEN