YouTube Transcript Generator

Download and generate clean, readable transcripts from any YouTube video. Extracts subtitles (auto-generated or manual), removes timestamps and formatting, a...

This skill is coherent and appears to do what it says, but check a few practical items before use: (1) Install yt-dlp from an official source (brew, pip, or the project's releases) because the script depends on it — the registry metadata omitted this requirement. (2) Review the bundled scripts (you already have them) and run them in a safe working directory; the script writes transcript_<VIDEO_ID>.txt to your current directory and uses a temporary folder for subtitles. (3) Run as a non-root user and try it on a harmless public video first to confirm behavior. (4) Be aware that yt-dlp will contact YouTube (network activity) and that downloading subtitles may have copyright/legal considerations in your jurisdiction. (5) Verify any external links in the SKILL.md before following them. If you want higher assurance, ask the publisher for provenance (source/homepage) or request the skill be updated so metadata lists yt-dlp/python3 as required binaries.

Type: OpenClaw Skill Name: youtube-transcript-generator Version: 1.0.0 The skill bundle is classified as suspicious due to a critical shell injection vulnerability in `scripts/get_transcript.sh`. The script directly interpolates the user-provided second argument (intended as an output filename) into shell commands like `python3 -c "..." > "$OUTPUT"`, `wc -l < "$OUTPUT"`, `wc -w < "$OUTPUT"`, and `cat "$OUTPUT"`. This allows an attacker to inject arbitrary shell commands by crafting a malicious output filename, leading to remote code execution. While the script's stated purpose is benign, this vulnerability poses a significant security risk.