YouTube Video Summarizer (Xiaolongxia)
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: xiaolongxia-youtube-summarizer Version: 1.1.0 The skill bundle is designed for YouTube video summarization. The `SKILL.md` provides clear, task-oriented instructions for the AI agent, utilizing `web_fetch` and `web_search` for legitimate content gathering from YouTube and related news sources. The `scripts/youtube-info.js` helper script performs web scraping on YouTube, confining its network requests to YouTube domains for video metadata and transcripts. The `evomap-publish.js` and `publish-to-evomap.js` scripts generate JSON payloads containing metadata about the skill itself (including `env_fingerprint` of the Node.js environment), but they only print this JSON to standard output and do not initiate any network requests to exfiltrate or publish this data externally. There is no evidence of intentional harmful behavior such as credential theft, unauthorized data exfiltration, persistence mechanisms, or malicious prompt injection.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Using the helper may run local JavaScript and make network requests to YouTube to retrieve metadata or captions.
The skill documents running a local Node.js helper script to fetch video information and transcripts. This is disclosed and central to the YouTube summarization purpose, but it is still local code execution users should be aware of.
node ~/.openclaw/workspace/skills/youtube-summarizer/scripts/youtube-info.js "https://youtu.be/YZVpUeEvGxs" --transcript
Use the helper only for videos you intend to summarize, and review the included script if you are cautious about local code execution.
Video summaries or key points may persist beyond the current conversation if the user or agent chooses to save them.
The skill suggests saving important video summaries into memory files for later reference. This is optional and purpose-related, but persistent notes can be reused across sessions.
重要视频总结可记录到 `memory/YYYY-MM-DD.md`; 使用 `MEMORY.md` 保存重要视频的关键信息
Only save summaries to memory when you want them retained, and avoid storing private or sensitive video content unless retention is intended.
If the generated payload is sent to EvoMap, skill metadata and minimal environment details such as platform, architecture, and Node version could be shared.
The included EvoMap script emits an agent-to-agent style publish envelope. The artifact only prints JSON and does not send it over the network, but it indicates an optional sharing/publication workflow.
protocol: 'gep-a2a', message_type: 'publish', sender_id: 'node_xiaolongxia_001'
Review any EvoMap payload before sending it, especially if you do not want skill details or environment fingerprints shared.
Users have less provenance information about where the skill came from, even though the included files can be inspected.
The registry metadata does not provide an external source or homepage, and the skill includes JavaScript helper files despite having no install specification. The supplied source is readable and does not show hidden installation behavior.
Source: unknown; Homepage: none; No install spec — this is an instruction-only skill.
Inspect the provided JavaScript files before use and prefer trusted sources for future updates.