Youtube Summarizer

YouTube and Bilibili video transcript extraction and AI-powered summarization. Use when you need to summarize a YouTube or Bilibili (B站) video, extract trans...

This skill generally does what it says, but review these before installing: - Be aware yt-dlp is invoked with '--cookies-from-browser chrome' — that will access Chrome cookies (possible session tokens). Only allow this if you understand and accept the privacy risk; prefer public videos or export cookies to a limited cookie file instead. - Inspect the rest of summarize.py (the parts not shown) to confirm where transcripts/summaries are sent. If the script calls external LLM/image services, check which endpoints are used and whether any tokens you provide could be exfiltrated. - Avoid supplying broad secrets (GITHUB_TOKEN, OPENCLAW_GATEWAY_TOKEN, etc.) unless you trust the skill and have inspected the code paths that use them. If unsure, run the skill in an isolated environment (container or VM) and monitor outbound network traffic. - The setup script expects Homebrew for yt-dlp install; on Linux manually install yt-dlp/ffmpeg before running setup. If you want, I can scan the remainder of summarize.py for where LLM/API calls are made (endpoints, headers, and any hardcoded URLs) and highlight exact lines that access cookies or environment tokens.

Type: OpenClaw Skill Name: oc-youtube-summarizer Version: 2.2.0 The skill is classified as suspicious due to high-risk data access and an extensive external communication chain. Specifically, `scripts/summarize.py` invokes `yt-dlp` with the `--cookies-from-browser chrome` flag when processing Bilibili videos, which allows the script to access sensitive browser data. Furthermore, the script implements a complex LLM fallback chain that utilizes sensitive environment variables (e.g., `GITHUB_TOKEN`, `OPENCLAW_GATEWAY_TOKEN`) to send video transcripts to multiple external endpoints, including an unofficial GitHub Copilot API and Pollinations.ai. While these features are technically aligned with the stated purpose of bypassing rate limits and generating summaries, the combination of browser cookie access and multi-provider data transmission represents a significant security and privacy risk.