Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Youtube Transcript Api

v0.1.0

Extract, transcribe, and translate YouTube video transcripts using the YouTubeTranscript.dev V2 API. Supports captions, ASR audio transcription, batch proces...

0· 621·0 current·0 all-time
byTaimur Khan@volodstaimi
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
The name/description describe extracting/translating YouTube transcripts and the SKILL.md provides concrete HTTP endpoints, examples, and an SDK reference that align with that purpose. No unrelated credentials, binaries, or installs are requested.
Instruction Scope
Instructions are narrowly scoped to calling the youtubetranscript.dev API (POST /transcribe, /batch, polling endpoints, webhook support). They instruct the agent to ask the user for an API key and to optionally provide a webhook URL for async ASR results. Webhook URLs can forward data outside the agent environment — expected for this API but worth noting as a data-exfiltration vector if misused.
Install Mechanism
No install spec or code files are present (instruction-only). No downloads or package installs are required by the skill itself. The SKILL.md mentions an npm SDK as an example but does not attempt to install it automatically.
Credentials
The skill requires an API key for youtubetranscript.dev (Authorization: Bearer ...) which is proportional to the described functionality. The skill declares no required environment variables — it expects the agent or user to supply an API key at runtime. This is reasonable, but users should avoid pasting high-privilege keys into untrusted contexts and be cautious about providing webhook URLs that accept callbacks.
Persistence & Privilege
always is false and the skill is instruction-only; it does not request persistent system presence or modify other skills/config. Default autonomous invocation remains allowed but not exceptional in this skill.
Assessment
This skill looks coherent for fetching/translating YouTube transcripts. Before installing or using it: only provide an API key if you trust the skill/provider (use a limited or test key if possible); avoid exposing sensitive credentials; be cautious when specifying a webhook_url — that endpoint will receive transcript data (don’t point it at an endpoint you don't control or trust); confirm the real provider/site (youtubetranscript.dev) and prefer creating/using a scoped API key there; monitor and rotate keys after use; be aware of costs/credit usage for batch or ASR jobs.

Like a lobster shell, security has layers — review code before you run it.

latestvk9747xcgr04238w31w04ssc1vx81dh81

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

YouTube Transcript API Skill

Use this skill when the user wants to extract transcripts from YouTube videos, transcribe videos without captions, translate video content, or process multiple videos in batch.

When to Use

  • User asks to get a transcript/subtitles/captions from a YouTube video
  • User wants to transcribe a YouTube video that has no captions (ASR)
  • User wants to translate a YouTube video transcript to another language
  • User needs to process multiple YouTube videos at once
  • User wants to build an AI/LLM pipeline that uses YouTube video content
  • User wants to repurpose video content into text (blog posts, summaries, etc.)

API Overview

Base URL: https://youtubetranscript.dev/api/v2

Authentication: Bearer token via Authorization: Bearer YOUR_API_KEY

Users can get a free API key at youtubetranscript.dev.

Endpoints

MethodEndpointDescription
POST/api/v2/transcribeExtract transcript from a single video
POST/api/v2/batchExtract transcripts from up to 100 videos
GET/api/v2/jobs/{job_id}Check status of an ASR job
GET/api/v2/batch/{batch_id}Check status of a batch request

Request Fields

FieldRequiredDescription
videoYes (single)YouTube URL or 11-character video ID
video_idsYes (batch)Array of IDs or URLs (up to 100)
languageNoISO 639-1 code (e.g., "es", "fr"). Omit for best available
sourceNoauto (default), manual, or asr
formatNotimestamp, paragraphs, or words
webhook_urlNoURL for async delivery (required for source="asr")

Credit Costs

MethodCostSpeed
Native Captions1 credit5–10 seconds
Translation1 credit per 2,500 chars5–10 seconds
ASR (Audio)1 credit per 90 seconds2–20 minutes (async)

Examples

Basic Transcript Extraction (Python)

import requests

API_KEY = "your_api_key"

response = requests.post(
    "https://youtubetranscript.dev/api/v2/transcribe",
    headers={
        "Authorization": f"Bearer {API_KEY}",
        "Content-Type": "application/json",
    },
    json={"video": "dQw4w9WgXcQ"}
)

data = response.json()
for segment in data["data"]["transcript"]:
    print(f"[{segment['start']:.1f}s] {segment['text']}")

Basic Transcript Extraction (JavaScript/Node.js)

const response = await fetch("https://youtubetranscript.dev/api/v2/transcribe", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ video: "dQw4w9WgXcQ" }),
});

const { data } = await response.json();
console.log(data.transcript);

Using the Node.js SDK

npm install youtube-audio-transcript-api
import { YouTubeTranscript } from "youtube-audio-transcript-api";

const yt = new YouTubeTranscript({ apiKey: "your_api_key" });

// Simple extraction
const result = await yt.getTranscript("dQw4w9WgXcQ");

// With translation
const translated = await yt.transcribe({
  video: "dQw4w9WgXcQ",
  language: "es",
});

// Batch (up to 100 videos)
const batch = await yt.batch({
  video_ids: ["dQw4w9WgXcQ", "jNQXAC9IVRw", "9bZkp7q19f0"],
});

Basic Transcript Extraction (cURL)

curl -X POST https://youtubetranscript.dev/api/v2/transcribe \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"video": "dQw4w9WgXcQ"}'

Batch Processing (up to 100 videos)

curl -X POST https://youtubetranscript.dev/api/v2/batch \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"video_ids": ["dQw4w9WgXcQ", "jNQXAC9IVRw", "9bZkp7q19f0"]}'

Translation

Add "language": "es" (or any ISO 639-1 code) to get the transcript translated:

curl -X POST https://youtubetranscript.dev/api/v2/transcribe \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"video": "dQw4w9WgXcQ", "language": "es"}'

ASR Transcription (videos without captions)

For videos that don't have captions, use ASR with a webhook:

curl -X POST https://youtubetranscript.dev/api/v2/transcribe \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"video": "VIDEO_ID", "source": "asr", "webhook_url": "https://yoursite.com/webhook"}'

This returns immediately with status: "processing". Results are delivered to the webhook URL when ready. Poll with GET /api/v2/jobs/{job_id} if not using webhooks.

Error Handling

HTTP StatusError CodeDescription
400invalid_requestInvalid JSON or missing required fields
401invalid_api_keyMissing or invalid API key
402payment_requiredInsufficient credits
404no_captionsNo captions available and ASR not used
429rate_limit_exceededToo many requests — check Retry-After header

Important Notes

  • Always ask the user for their API key if they haven't provided one. Free keys are available at youtubetranscript.dev.
  • Omitting the language parameter returns the best available transcript without translation (saves credits).
  • ASR is async — always use a webhook URL or poll the jobs endpoint.
  • Batch endpoint accepts both YouTube URLs and 11-character video IDs.
  • Re-fetching an already-owned transcript costs 0 credits.

Resources

Files

1 total
Select a file
Select a file to preview.

Comments

Loading comments…