Youtube Transcribe Skill

Extract subtitles/transcripts from YouTube videos. Triggers: "youtube transcript", "extract subtitles", "video captions", "视频字幕", "字幕提取", "YouTube转文字", "提取字幕".

This skill appears to do what it says: extract YouTube transcripts using yt-dlp or browser automation. Before installing, consider: (1) yt-dlp --cookies-from-browser will access your browser cookie store to handle sign-in-protected videos — only proceed if you are comfortable with that and trust the runtime. (2) The fallback uses a chrome-devtools plugin to open pages and run JavaScript on them; review what that plugin can access in your environment. (3) SKILL.md mentions 'WebFetch'/'firecrawl' but those tools aren't declared — if the agent attempts those, verify what implementation will be used. (4) No external credentials are requested and nothing is downloaded by the skill itself, which reduces risk. If you plan to use this skill, ensure yt-dlp and/or the specified mcp plugin are installed from trusted sources and avoid running it in environments where exposing browser cookies would be unacceptable.

Type: OpenClaw Skill Name: youtube-transcribe-skill Version: 0.1.0 The skill is classified as suspicious due to the use of powerful capabilities that, while potentially functional for its stated purpose, introduce significant security risks. Specifically, the `SKILL.md` instructions allow `yt-dlp` to access browser cookies via `--cookies-from-browser`, and critically, grant the agent the ability to execute arbitrary JavaScript in the user's browser context using `mcp__plugin_claude-code-settings_chrome__evaluate_script`. While the provided JavaScript is benign, this capability represents a browser-side Remote Code Execution (RCE) vulnerability, making the skill highly susceptible to prompt injection attacks for data exfiltration or other malicious browser actions.