YouTube Uploader

Upload videos and custom thumbnails to YouTube. Use when the user wants to publish, upload, or post a video to YouTube, set a thumbnail, or manage YouTube ch...

Security Scan

The skill's code, instructions, and requirements are consistent with a YouTube uploader: it uses OAuth, stores user credentials locally, and installs the Google API client into a local venv — nothing in the package indicates extraneous or hidden data exfiltration.

Purpose & Capability

Name/description (upload videos & thumbnails) match the included script and SKILL.md. Required binary is python3 and the script uses the YouTube Data API via OAuth2 — these are appropriate and expected.

Instruction Scope

SKILL.md instructs the user to run the script's auth/upload/thumbnail commands and to provide a Google OAuth client_secret.json. The runtime instructions operate only on local files (video, thumbnail, client_secret.json) and the Google APIs; they do not request unrelated system files or external endpoints beyond Google and a localhost redirect for OAuth.

Install Mechanism

No install spec in registry, but the script bootstraps a per-user virtualenv at ~/.openclaw/youtube/.venv and installs packages from PyPI (pip). This is reasonable for a Python tool but does create writable files and executes pip installs on first run — users should be aware of that behavior.

Credentials

The skill does not request environment variables or unrelated credentials. It requires the user-provided Google client_secret.json and stores OAuth tokens locally; no other secrets are requested or transmitted by the skill.

Persistence & Privilege

The script creates a per-user directory (~/.openclaw/youtube), writes client_secret.json and channels.json (with owner-only permissions), and creates a virtualenv. It does not set always:true, does not modify other skills, and does not require elevated privileges, but it does persist tokens and installed packages in the user's home directory.

Assessment

This skill appears to do exactly what it says: perform OAuth2 with Google and upload videos via the YouTube Data API. Before installing/running, consider: 1) You must create/download the Google client_secret.json yourself — verify it comes from your Google Cloud project. 2) The script will create ~/.openclaw/youtube/, save your client_secret.json and OAuth tokens there, and create a virtualenv and pip-install packages from PyPI; review the script if you want to audit behavior first. 3) If you ever want to revoke access, remove the saved channels.json and revoke the OAuth refresh token in your Google account. 4) If you are uncomfortable with automatic pip installs, run the script inside a controlled virtual environment you create yourself. Overall the package is coherent with its stated purpose and contains no obvious exfiltration or unrelated privileges.

Upload videos with full metadata and custom thumbnails to YouTube via OAuth2.

Setup (one-time)

The user needs a Google Cloud project with the YouTube Data API v3 enabled and an OAuth2 client ID (type "Desktop app"). Download the client_secret.json file.

Authenticate

python3 {baseDir}/scripts/youtube-upload.py auth --client-secret /path/to/client_secret.json

This opens a browser for Google OAuth consent, then saves credentials to ~/.openclaw/youtube/channels.json. Multiple channels can be authenticated by repeating the command with different Google accounts.

List authenticated channels

python3 {baseDir}/scripts/youtube-upload.py channels

Upload a video

python3 {baseDir}/scripts/youtube-upload.py upload \
  --file /path/to/video.mp4 \
  --title "Video Title" \
  --description "Video description" \
  --tags "tag1,tag2,tag3" \
  --category 22 \
  --privacy private \
  --channel-id UCxxxxxxxx

Required: --file, --title Optional: --description, --tags (comma-separated), --category (default 22 = People & Blogs), --privacy (private/unlisted/public, default private), --publish-at (ISO 8601 for scheduled publish, requires privacy=private), --made-for-kids, --channel-id (uses first channel if omitted)

Returns JSON with videoId and url.

Upload a custom thumbnail

python3 {baseDir}/scripts/youtube-upload.py thumbnail \
  --video-id VIDEO_ID \
  --file /path/to/thumbnail.jpg \
  --channel-id UCxxxxxxxx

Supports JPEG, PNG, BMP, GIF. Max 2MB per YouTube API. The channel must be verified for custom thumbnails.

Refresh token manually

python3 {baseDir}/scripts/youtube-upload.py refresh --channel-id UCxxxxxxxx

Workflow tips

• Always upload as --privacy private first, verify, then update privacy if needed.
• Upload thumbnail immediately after video upload using the returned videoId.
• If auth expires, re-run the auth subcommand.
• When the user doesn't specify a category, default to 22. See references/categories.md for the full list.

References

• See references/categories.md for YouTube video category IDs.