Youtube → Pocket Casts

Download YouTube videos and upload them to Pocket Casts Files for offline viewing. For personal use with content you own or have rights to.

This skill appears to do what it claims, but take these precautions before installing or using it: - Only provide a Pocket Casts refresh token and YouTube cookies you control; these contain session-level access — store them with strict permissions (the guide already sets 600/700). If leaked, they could be abused. - The SKILL.md recommends installing deno by piping a remote script to sh; avoid running remote install scripts unless you trust the source — prefer package manager installs if available. - Confirm you have the right to download and upload content; downloading YouTube content may violate YouTube's ToS and/or copyright law depending on the content and your jurisdiction. - Verify yt-dlp is installed and callable (script uses 'uvx yt-dlp'); running the script in an isolated or disposable environment (or reviewing the uploaded file contents) reduces risk. - Review the included scripts (scripts/upload.sh) yourself before running and keep credentials offline until ready. If you want higher assurance, run a dry run on non-sensitive content first.

Type: OpenClaw Skill Name: pocket-casts-yt Version: 1.0.0 The skill is classified as suspicious primarily due to the `SKILL.md` file instructing users to install Deno via `curl -fsSL https://deno.land/install.sh | sh`. This method of executing arbitrary remote code during prerequisite setup poses a significant supply chain risk. While the core `upload.sh` script's functionality aligns with its stated purpose of downloading YouTube videos and uploading them to Pocket Casts, and it handles credentials (Pocket Casts refresh token, YouTube cookies) with appropriate file permissions, the `curl | sh` installation step for a dependency is a high-risk behavior. The script interacts with `api.pocketcasts.com` and `deno.land`.