u2-downloader
PassAudited by ClawScan on May 10, 2026.
Overview
This is a disclosed instruction-only wrapper around a third-party YouTube download API, but users should notice it requires a pay-per-use API key and sends video URLs to an external service.
Install only if you are comfortable registering with u2foru.site, providing its API key to OpenClaw, and having selected YouTube URLs processed by that service. Monitor paid credits and avoid sensitive links unless you trust the provider’s privacy and storage practices.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Using the skill means trusting the provider with an API key that may spend credits for successful downloads.
The skill requires a bearer API key for a third-party account. This is disclosed and purpose-aligned, but the key can authorize account activity and should be treated as a credential.
All API calls require an API Key in the Authorization header: Authorization: Bearer sk-yt-xxxxx
Use only a provider-scoped key, monitor credit usage, and rotate or revoke the key if you stop using the service.
The agent may send the video URL and chosen resolution to the provider when you ask for a download.
The skill documents making an authenticated external API call with a user-supplied YouTube URL and resolution. This is expected for the downloader purpose, but it is still a network action with account-side effects.
curl -X POST https://u2foru.site/api/v1/skill/download ... -d '{"youtube_url": "https://youtube.com/watch?v=dQw4w9WgXcQ", "resolution": "720"}'Review the requested URL and quality before asking the agent to download, especially because successful calls may use paid credits.
You must trust the external service and its terms because the reviewed package does not include the downloader implementation.
The artifact set contains only documentation and points to an external service, so the provider backend, billing behavior, and implementation cannot be reviewed from the supplied artifacts.
Source: unknown Homepage: none No install spec — this is an instruction-only skill.
Check the provider’s website, pricing, privacy policy, and reputation before registering or adding credits.
Downloaded media and the original YouTube URL may be processed or stored outside your local environment.
The documented response shows the downloaded media is returned through external cloud storage. This is purpose-aligned, but retention, access control, and sharing behavior are not described.
"download_url": "https://oss-bucket.aliyuncs.com/skill/abc123/video.mp4"
Avoid using the skill for private or sensitive video links unless you are comfortable with the provider’s storage and retention practices.