YouTube Transcript (yt-dlp captions)

Extract YouTube video transcripts from existing captions (manual or auto-generated) using yt-dlp, with optional timestamps and local SQLite caching. Use when...

This skill appears to do what it claims: extract YouTube captions using yt-dlp and an optional YouTube transcript-panel fallback. Before installing, ensure you have yt-dlp on PATH and understand that the script will contact YouTube (network access) and write a local cache (default {baseDir}/cache/transcripts.sqlite or ~/.config/yt-transcript/). If you need authenticated access on restricted IPs, provide a cookies.txt file in Netscape format and keep it outside the skill folder (e.g., ~/.config/yt-transcript/) because cookies are secrets and can be mispublished. Finally, review and approve running subprocesses (yt-dlp) in your environment since the script invokes yt-dlp and performs HTTP requests to YouTube.

Type: OpenClaw Skill Name: youtube-transcript-yt-dlp Version: 1.0.5 The skill bundle is suspicious due to the presence of fully implemented, but currently unused, functions (`_thirdparty_tubetranscript`, `_thirdparty_downsub`, `_thirdparty_noteey` in `scripts/yt_transcript.py`) designed to send YouTube video IDs to third-party transcript providers (yt-to-text.com, downsub.com, noteey.com). This directly contradicts explicit statements in `SKILL.md` that the published version 'does not call third-party transcript providers' and 'does not send video IDs/URLs to third-party transcript providers'. While these functions are not actively called in the current execution flow, their presence represents a latent capability for data exfiltration and a significant discrepancy between stated policy and code capabilities, raising trust concerns. The code otherwise implements good security practices like input validation and path allowlisting for cookies and cache.