Youtube Master
PassAudited by ClawScan on May 1, 2026.
Overview
This skill appears to match its stated purpose of fetching YouTube metadata and optional transcripts, but users should notice its API credential use and a setup mismatch around environment variables.
Before installing, confirm how you want to provide credentials. The included code reads Google and Apify keys from ~/.openclaw/workspace/credentials/api-credentials.json, despite the documentation mentioning environment variables. Use Apify only when you need transcripts.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill can consume YouTube API quota and, when transcripts are requested, use an Apify account token that may affect Apify usage or billing.
The script reads API credentials from a local OpenClaw credentials file. This is disclosed and purpose-aligned for YouTube and Apify access, but users should understand that the skill uses account/API credentials.
creds_path = Path.home() / ".openclaw" / "workspace" / "credentials" / "api-credentials.json"
Use restricted API keys where possible, provide the Apify token only if you need transcript retrieval, and monitor provider usage.
Users may configure credentials in environment variables and find the script still fails, or may provide an Apify token even when only basic video metadata is needed.
The documentation presents environment variables as a setup option, while the provided Python source only shows credential-file loading and does not read these environment variables. This looks like a setup inconsistency rather than malicious behavior.
export YOUTUBE_API_KEY="AIzaSy..." export APIFY_TOKEN="apify_api_..."
Verify the credential method before use; based on the provided source, the credentials file path is the reliable setup method unless the script is updated to read environment variables.