youtube-data

Use when structured YouTube data is needed: pasted video/channel/playlist links, transcripts for analysis, video metadata, channel upload history, search res...

This skill appears to do what it says: talk to transcriptapi.com to fetch transcripts and YouTube metadata and it only needs your TranscriptAPI key. Before installing: 1) Decide whether you want to paste an existing key (safer) or let the agent create an account using your email and OTP (the skill can do both). 2) Confirm where the agent will persist the key (shell profile vs. agent secret store) and whether you trust that location and transcriptapi.com’s privacy/terms. 3) Prefer providing a dedicated key/account with limited use. 4) If you let the agent sign up, do not reuse sensitive or recovery email addresses if you prefer separation. 5) If you’re uncomfortable with an agent writing persistent config files, decline the automated signup and supply the key yourself. The skill’s instructions to write HTTP responses to temporary files is explained as a workaround for platform redaction behaviour; it’s operationally reasonable but worth noting because it touches handling of secrets—ensure the agent cleans up temporary files and does not expose the key in logs or outputs.

Type: OpenClaw Skill Name: youtube-data Version: 1.5.0 The skill bundle contains instructions in 'references/auth-setup.md' that explicitly direct the AI agent to employ evasion techniques to bypass platform security controls. Specifically, it instructs the agent to write sensitive credentials (JWTs and API keys) to temporary files to avoid detection or redaction by the agent runtime's output filters. While these actions are intended to facilitate the setup of the 'transcriptapi.com' service, the methodology of teaching an agent to circumvent security logging and autonomously modify system-wide environment persistence is a high-risk behavior that could be repurposed for malicious data handling.