Youtube Instant Article

Transform YouTube videos into Telegraph Instant View articles with visual slides and timestamped summaries. Use this skill whenever a user shares a YouTube URL (youtube.com or youtu.be) and asks to summarize, explain, or process the video. This is the DEFAULT skill for all YouTube video requests - do NOT use the generic summarize tool for YouTube.

Key things to consider before installing or running this skill: - Secrets are required but not declared: The scripts expect TELEGRAPH_TOKEN and the summarize workflow expects an OpenAI key (SKILL.md/README), yet the registry metadata lists no required env vars. Confirm the manifest is updated to declare these credentials before trusting the skill. - Unexpected .env sourcing: SKILL.md suggests sourcing /Users/viticci/clawd/.env and the wrapper will source $HOME/clawd/.env if present. That is unusual: the skill may read any secrets in those files. Do not run the scripts if you keep unrelated secrets in such files; instead set only the necessary env variables in a controlled shell or dedicated .env in the project directory. - Inspect network endpoints: The scripts upload images to catbox.moe and publish pages to api.telegra.ph; these are expected but are network calls that send image data and the Telegraph access token. If you have policy concerns about public image hosting or third-party storage, replace or review that behavior. - Run in a sandbox first: Execute the scripts in a controlled environment (throwaway account / container) to confirm behavior. Use a test Telegraph account and a limited OpenAI key or billing guard to avoid unexpected costs or exposure. - Request fixes from the publisher: ask the skill author to (1) declare required env vars in registry metadata (TELEGRAPH_TOKEN, OPENAI_API_KEY), (2) remove hard-coded personal paths (/Users/viticci/...) and the unexpected $HOME/clawd/.env sourcing, and (3) document exactly what is read/sent. If the author cannot justify those oddities, avoid using the skill. Confidence: medium — the code contains clear mismatches and surprising behavior, but there is no direct evidence of intentional exfiltration to unknown endpoints; the issues could be sloppy packaging or an oversight. Additional confirmation (author clarification or updated manifest) would raise confidence.

Type: OpenClaw Skill Name: youtube-instant-article Version: 0.1.0 The skill is classified as suspicious due to its reliance on broad shell access (`Bash(summarize:*)`, `Bash(curl:*)`, `Bash(jq:*)`) and direct network communication with external services (`catbox.moe`, `api.telegra.ph`, `openai.com`) as defined in `SKILL.md` and implemented in `scripts/generate.sh`. While these capabilities are plausibly needed for the skill's stated purpose (generating articles from YouTube videos), they represent significant high-risk behaviors that could be exploited if the agent or skill were compromised. Additionally, `SKILL.md` specifies a hardcoded path (`/Users/viticci/clawd/.env`) for loading environment variables, which, while intended for configuration, is a specific and potentially non-portable method for accessing sensitive data.