ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Youtube Channels

v1.4.1

Work with YouTube channels — resolve handles to IDs, browse uploads, get latest videos, search within channels. Use when the user asks about a specific channel, wants to see recent uploads, or says "what has X posted lately", "latest from TED", "show me their channel", "list channel videos", "browse channel uploads".

⭐ 0· 3k·3 current·3 all-time
byRohit Das@therohitdas
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description, required env (TRANSCRIPT_API_KEY), and required binary (node) all match a small client for TranscriptAPI.com YouTube endpoints. Declared config path (~/.openclaw/openclaw.json) is used to store the API key so the skill can run — this is coherent for the stated purpose.
✓
Instruction Scope
SKILL.md instructs using the provided CLI script for passwordless account setup, and using the TranscriptAPI endpoints via curl. The runtime instructions only reference the declared config path and the API service; they do not ask the agent to read unrelated files or exfiltrate other credentials.
✓
Install Mechanism
No install spec is provided (instruction-only); a single included Node script is present and intended to be executed locally. There are no downloads or archive extracts from untrusted URLs in the skill package itself.
✓
Credentials
Only TRANSCRIPT_API_KEY is required and is the primary credential; the skill does not request additional unrelated secrets. The CLI asks for an email/OTP during registration but those are part of the auth flow, not hidden credential requests.
✓
Persistence & Privilege
always is false and the skill does not request elevated or cross-skill config changes. The script writes the API key into its own declared OpenClaw config path and backs up the existing file, which is a reasonable self-configuration step for runtime use.
Assessment
This skill appears to do what it says: it uses TranscriptAPI to resolve channels and list videos and requires a single API key. Before installing/run the CLI: (1) review and be comfortable with writing your API key to ~/.openclaw/openclaw.json (the script backs up the file to .bak), (2) ensure you trust transcriptapi.com and create the API key via their site if you prefer not to run the bundled script, (3) note the script requires node and will reject disposable email addresses during register, and (4) if you prefer manual control, you can set TRANSCRIPT_API_KEY in your shell profile instead of using the save-to-config flow. Overall the package is internally consistent; proceed if you trust the TranscriptAPI service and are okay with the OpenClaw config change.

Like a lobster shell, security has layers — review code before you run it.

latestvk972kxj24v5kwr47pz1p0psd3d80yezv

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📡 Clawdis
Binsnode
EnvTRANSCRIPT_API_KEY
Config~/.openclaw/openclaw.json
Primary envTRANSCRIPT_API_KEY

Comments