YouTube Music Cast

Download music from YouTube/YouTube Music and stream to Chromecast via Home Assistant. Complete CLI toolset with web server integration, configuration wizard, and playback controls.

Before installing or running anything from this skill: 1) Verify the upstream GitHub repository and inspect install.sh and any scripts for network downloads, eval/exec calls, or commands that run as root. 2) Don’t paste your Home Assistant token into unknown scripts — create a dedicated HA account with the minimum permissions needed (or a token limited to media_player), and inspect how/where the token is stored (ensure file permissions and consider encrypting it). 3) Run the install in a sandbox/VM if you can, or at least review all files first. 4) Confirm the HTTP server will bind only to your LAN interface (not 0.0.0.0 on a public network) and lock down firewall rules as needed. 5) Install yt-dlp and Python from trusted sources and be mindful of legal/ToS implications of downloading content. The package's lack of included code and the mismatch between registry metadata and SKILL.md are the primary red flags — treat this as untrusted until you review the external repo and scripts.

Type: OpenClaw Skill Name: ytm-cast Version: 6.0.0 The skill is classified as suspicious due to the requirement and storage of a Home Assistant Long-Lived Access Token in a plain text configuration file (`~/.youtube-music-cast/config.sh`), and the operation of a local HTTP server (`python3 -m http.server`) on the user's network. While these capabilities are necessary for the skill's stated purpose of casting music, they represent significant security risks by exposing sensitive credentials and opening a network port. There is no evidence of intentional malicious behavior or prompt injection attempts against the agent in the `SKILL.md`.