YouTube 批量发布器

支持批量上传视频到YouTube，自动设置标题、描述、标签、隐私及自定义缩略图，提供上传进度和状态查询功能。

This skill appears to do what it claims, but check these before installing: 1) Replace the included credentials/youtube_credentials.json with your own OAuth client credentials from Google Cloud (do not use someone else's client_secret). 2) Be aware the tool runs an interactive local OAuth flow (it will open a localhost port) and stores tokens in credentials/token.pickle — protect that file. 3) Install the documented Python dependencies (google-api-python-client, google-auth-httplib2, google-auth-oauthlib) and run with Python 3.7+. 4) Verify the repository/author if you plan to use it in production (the package.json lists an external repo and contact info). 5) If you need non-interactive/CI uploads, implement a service account or proper OAuth flow rather than embedding credentials. If any credential file included looks real or you don't control the OAuth client, treat it as sensitive and do not reuse it.

Type: OpenClaw Skill Name: youtube-bulk-publisher Version: 1.0.0 The skill provides legitimate YouTube video uploading functionality but contains a security vulnerability in youtube_publisher.py due to the use of pickle.load() for handling OAuth tokens, which is susceptible to insecure deserialization. Additionally, the script stores sensitive credentials and session tokens within the skill's local directory (credentials/), posing a risk of accidental credential exposure. While these appear to be unintentional design flaws rather than malicious intent, they represent high-risk behaviors in an automated agent environment.