Youtube Instant Article

PassAudited by ClawScan on May 10, 2026.

Overview

This skill appears to do what it advertises, but it uses API tokens and publishes video-derived content to external services, so users should understand those side effects.

Install this only if you want YouTube requests to create Telegraph Instant View articles. Be aware that it uses your Telegraph token and OpenAI API key, uploads extracted video images to catbox.moe, and publishes content to Telegraph rather than keeping all output local.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence
ASI01: Agent Goal Hijack
What this means

A normal request like 'summarize this YouTube video' may result in a Telegraph article workflow rather than a simple text summary.

Why it was flagged

The instruction is scoped to YouTube, but it strongly steers the agent away from generic summarization and toward this publishing workflow.

Skill content
This is the DEFAULT skill for all YouTube video requests - do NOT use the generic summarize tool for YouTube.
Recommendation

Use this skill when an external Telegraph article is desired; for simple private summaries, ask the agent not to publish or use this workflow.

What this means

The skill can create pages under the configured Telegraph account and may incur OpenAI API usage through the summarize tool.

Why it was flagged

The skill relies on user API credentials to publish to Telegraph and use OpenAI-backed summarization; these credentials are expected for the purpose, but are not declared in registry metadata.

Skill content
Required environment variables are loaded from `/Users/viticci/clawd/.env`:
- `TELEGRAPH_TOKEN` - Telegraph API access token
- `OPENAI_API_KEY` - For GPT-5.2 summarization
Recommendation

Store tokens securely, use only credentials intended for this workflow, and revoke or rotate them if the skill is no longer needed.

What this means

Slides and summaries derived from the video may become externally hosted and accessible through generated URLs.

Why it was flagged

The script uploads extracted video slides to catbox.moe and publishes the generated article to Telegraph. This is disclosed and purpose-aligned, but it crosses external data boundaries.

Skill content
url=$(curl -s "https://catbox.moe/user/api.php" -F "reqtype=fileupload" -F "fileToUpload=@$slide" ...)
...
RESPONSE=$(curl -s -X POST "https://api.telegra.ph/createPage" ...)
Recommendation

Only use the skill for videos and generated summaries you are comfortable publishing to external hosting services.

What this means

Installation depends on tools outside this artifact set, so their provenance and behavior are not fully reviewed here.

Why it was flagged

The skill depends on external command-line tools, including a third-party Homebrew tap, and the registry metadata does not declare these runtime requirements.

Skill content
brew install steipete/tap/summarize

# Install jq (JSON processor)
brew install jq
Recommendation

Install dependencies from trusted sources, verify versions, and review the summarize CLI configuration before using API credentials.