subtitles

ReviewAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is aligned with fetching YouTube subtitles, but it requires a TranscriptAPI credential and sends requested video identifiers to transcriptapi.com.

Before installing, make sure you are comfortable using TranscriptAPI as the third-party transcript provider. If setup is needed, confirm where the TRANSCRIPT_API_KEY will be stored, keep it out of public logs, and revoke or delete it if you stop using the skill.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI03: Identity and Privilege Abuse

What this means

The agent may store a TranscriptAPI key that can spend the user’s TranscriptAPI credits in future sessions.

Why it was flagged

The skill asks the agent to handle and persist a service API key. This is disclosed and purpose-aligned, but it is still sensitive credential handling.

Skill content

You now have a string that starts with `sk_`. This is the `TRANSCRIPT_API_KEY`.

Store it persistently using whatever method is correct for this environment

Recommendation

Only provide or create a TranscriptAPI key if you trust this service, and confirm where the key will be stored and how to revoke or remove it.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

TranscriptAPI will learn which YouTube videos the user asks to transcribe, and it receives the credential needed to authorize the request.

Why it was flagged

Transcript requests send the requested YouTube URL or ID, plus the API credential, to transcriptapi.com. This external provider flow is clearly documented and matches the skill’s purpose.

Skill content

curl -s "https://transcriptapi.com/api/v2/youtube/transcript\
?video_url=VIDEO_URL&format=text&include_timestamp=false&send_metadata=true" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"

Recommendation

Use the skill only for videos you are comfortable sending to TranscriptAPI, and avoid sharing sensitive private video links unless you trust the provider.