Nate B Jones Digest

Monitor Nate B Jones's YouTube channel, pull each new video transcript (YouTube captions or auto-transcribed audio), summarize it with an abstract + bullet h...

This skill appears to do what it says (poll YouTube, transcribe, summarize, publish), but take these precautions before installing or running it: - Do NOT run with the bundled config.yml unchanged. The provided config already has email delivery enabled and a hard-coded recipient ([email protected]). If you run the workflow without editing config, summaries could be sent to that external address. - Expect to provide credentials yourself: a YouTube API key (or rely on yt-dlp), and Google/Gmail/Docs authorization if you use the 'gog' publishing path. Also supply any chat/webhook tokens (Telegram/Control UI/Slack) you intend to use. The skill metadata does not declare these env vars, so be explicit about what you configure. - Inspect and control where logs/transcripts are stored. The skill keeps full transcripts in logs; if transcripts contain sensitive info, ensure archive_dir is secure and retention is acceptable. - Install and run external tools (yt-dlp, Whisper, youtube_transcript_api, gog) in a controlled environment; these CLIs will download audio and write files to disk. - Before enabling automation (cron), run one manual test with outputs disabled or directed to a trusted, controlled address to verify behavior. - If you need higher assurance, ask the publisher to update the skill metadata to declare required env vars and remove or neutralize any default external recipients. If you cannot verify the publisher, treat the default config as suspicious and do not use it as-is.

Type: OpenClaw Skill Name: nate-b-jones-digest Version: 1.0.0 The 'nate-b-jones-digest' skill is a legitimate automation tool designed to monitor a specific YouTube channel, transcribe videos using Whisper or official captions, and distribute summaries via email, chat, or Google Docs. The skill uses standard utilities such as yt-dlp, whisper, and a helper tool called 'gog' for its operations. While the instructions in SKILL.md involve shell execution and the handling of API keys/passwords via environment variables, these actions are directly aligned with the stated purpose of the skill and do not exhibit signs of malicious intent or data exfiltration. The provided logs and transcript further confirm that the skill functions as described, even including educational content about AI safety and prompt injection risks within the processed video transcript.