Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Youtube Full

Complete YouTube toolkit — transcripts, search, channels, playlists, and metadata all in one skill. Use when you need comprehensive YouTube access, want to search and then get transcripts, browse channel content, work with playlists, or need the full suite of YouTube data endpoints. The all-in-one YouTube skill for agents.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
16 · 8.6k · 37 current installs · 42 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (YouTube transcripts, search, channels, playlists) align with the declared requirements: node is required to run the included CLI helper, TRANSCRIPT_API_KEY is the API credential for transcriptapi.com, and the config path (~/.openclaw/openclaw.json) is where the script stores the key. Nothing requested appears unrelated to the claimed functionality.
Instruction Scope
SKILL.md and scripts/tapi-auth.js instruct the agent to create a passwordless account (email → OTP → API key) and to save the API key into ~/.openclaw/openclaw.json (backing up the file first). That is within scope for providing the described API access, but it does mean the agent will ask the user for an email and OTP and will write credentials to the local OpenClaw config — users should expect that behavior and confirm they want the agent to perform account creation on their behalf.
Install Mechanism
No install spec (instruction-only) and a single small helper script are included. There are no external downloads or archive extracts; the only runtime requirement is node, which is declared. This is lower risk than arbitrary remote installs.
Credentials
Only TRANSCRIPT_API_KEY is required (declared as primaryEnv). No unrelated credentials, passwords, or other service tokens are requested. The script uses and stores exactly that key in the OpenClaw config and does not request additional env vars in the visible code.
Persistence & Privilege
always is false (not force-included); the skill writes only to its own OpenClaw config path (~/.openclaw/openclaw.json) and creates a .bak of existing file. It does not request system-wide changes or modify other skills' configs in the provided code.
Assessment
This skill appears to do what it says: it uses TranscriptAPI and needs your TRANSCRIPT_API_KEY. Before installing, confirm you trust transcriptapi.com and are comfortable providing an email (and entering the OTP) for account creation. The helper script will save the API key into ~/.openclaw/openclaw.json and makes a .bak of the existing file — inspect that file after onboarding. Ensure node is present on the host. If you prefer, create an API key manually on transcriptapi.com and set TRANSCRIPT_API_KEY yourself (or paste into openclaw.json) instead of letting the agent perform registration. If the key is ever exposed or you have doubts, revoke it from your TranscriptAPI dashboard.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.4.1
Download zip
latestvk9795066wj5bq7atfbhdq5stys80yfb3

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

🎯 Clawdis
Binsnode
EnvTRANSCRIPT_API_KEY
Config~/.openclaw/openclaw.json
Primary envTRANSCRIPT_API_KEY

SKILL.md

YouTube Full

Complete YouTube toolkit via TranscriptAPI.com. Everything in one skill.

Setup

If $TRANSCRIPT_API_KEY is not set, help the user create an account (100 free credits, no card):

Step 1 — Register: Ask user for their email.

node ./scripts/tapi-auth.js register --email USER_EMAIL

→ OTP sent to email. Ask user: "Check your email for a 6-digit verification code."

Step 2 — Verify: Once user provides the OTP:

node ./scripts/tapi-auth.js verify --token TOKEN_FROM_STEP_1 --otp CODE

API key saved to ~/.openclaw/openclaw.json. See File Writes below for details. Existing file is backed up before modification.

Manual option: transcriptapi.com/signup → Dashboard → API Keys.

File Writes

The verify and save-key commands save the API key to ~/.openclaw/openclaw.json (sets skills.entries.transcriptapi.apiKey and enabled: true). Existing file is backed up to ~/.openclaw/openclaw.json.bak before modification.

To use the API key in terminal/CLI outside the agent, add to your shell profile manually: export TRANSCRIPT_API_KEY=<your-key>

API Reference

Full OpenAPI spec: transcriptapi.com/openapi.json — consult this for the latest parameters and schemas.

Transcript — 1 credit

curl -s "https://transcriptapi.com/api/v2/youtube/transcript\
?video_url=VIDEO_URL&format=text&include_timestamp=true&send_metadata=true" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"
ParamRequiredDefaultValues
video_urlyesYouTube URL or 11-char video ID
formatnojsonjson, text
include_timestampnotruetrue, false
send_metadatanofalsetrue, false

Response (format=json):

{
  "video_id": "dQw4w9WgXcQ",
  "language": "en",
  "transcript": [{ "text": "...", "start": 18.0, "duration": 3.5 }],
  "metadata": { "title": "...", "author_name": "...", "author_url": "..." }
}

Search — 1 credit

# Videos
curl -s "https://transcriptapi.com/api/v2/youtube/search?q=QUERY&type=video&limit=20" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"

# Channels
curl -s "https://transcriptapi.com/api/v2/youtube/search?q=QUERY&type=channel&limit=10" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"
ParamRequiredDefaultValidation
qyes1-200 chars
typenovideovideo, channel
limitno201-50

Channels

All channel endpoints accept channel — an @handle, channel URL, or UC... channel ID. No need to resolve first.

Resolve handle — FREE

curl -s "https://transcriptapi.com/api/v2/youtube/channel/resolve?input=@TED" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"

Response: {"channel_id": "UC...", "resolved_from": "@TED"}

Latest 15 videos — FREE

curl -s "https://transcriptapi.com/api/v2/youtube/channel/latest?channel=@TED" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"

Returns exact viewCount and ISO published timestamps.

All channel videos — 1 credit/page

# First page (100 videos)
curl -s "https://transcriptapi.com/api/v2/youtube/channel/videos?channel=@NASA" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"

# Next pages
curl -s "https://transcriptapi.com/api/v2/youtube/channel/videos?continuation=TOKEN" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"

Provide exactly one of channel or continuation. Response includes continuation_token and has_more.

Search within channel — 1 credit

curl -s "https://transcriptapi.com/api/v2/youtube/channel/search\
?channel=@TED&q=QUERY&limit=30" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"

Playlists — 1 credit/page

Accepts playlist — a YouTube playlist URL or playlist ID.

# First page
curl -s "https://transcriptapi.com/api/v2/youtube/playlist/videos?playlist=PL_ID" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"

# Next pages
curl -s "https://transcriptapi.com/api/v2/youtube/playlist/videos?continuation=TOKEN" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"

Valid ID prefixes: PL, UU, LL, FL, OL. Response includes playlist_info, results, continuation_token, has_more.

Credit Costs

EndpointCost
transcript1
search1
channel/resolvefree
channel/latestfree
channel/videos1/page
channel/search1
playlist/videos1/page

Validation Rules

FieldRule
channel@handle, channel URL, or UC... ID
playlistPlaylist URL or ID (PL/UU/LL/FL/OL prefix)
q1-200 chars
limit1-50

Errors

CodeMeaningAction
401Bad API keyCheck key
402No creditstranscriptapi.com/billing
404Not foundResource doesn't exist or no captions
408TimeoutRetry once after 2s
422Validation errorCheck param format
429Rate limitedWait, respect Retry-After

Typical Workflows

Research workflow: search → pick videos → fetch transcripts

# 1. Search
curl -s "https://transcriptapi.com/api/v2/youtube/search\
?q=machine+learning+explained&limit=5" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"
# 2. Transcript
curl -s "https://transcriptapi.com/api/v2/youtube/transcript\
?video_url=VIDEO_ID&format=text&include_timestamp=true&send_metadata=true" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"

Channel monitoring: latest (free) → transcript

# 1. Latest uploads (free — pass @handle directly)
curl -s "https://transcriptapi.com/api/v2/youtube/channel/latest?channel=@TED" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"
# 2. Transcript of latest
curl -s "https://transcriptapi.com/api/v2/youtube/transcript\
?video_url=VIDEO_ID&format=text&include_timestamp=true&send_metadata=true" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"

Free tier: 100 credits, 300 req/min. Starter ($5/mo): 1,000 credits.

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…