Is ZeroPointRepo/youtube-skills safe?
https://github.com/ZeroPointRepo/youtube-skills
ZeroPointRepo/youtube-skills is a collection of YouTube data extraction skills that wrap the TranscriptAPI.com service. The SKILL.md files are clean markdown with no executable code, no prompt injection, and no canary exfiltration detected during sandboxed installation. The primary concerns are: auth-setup.md explicitly teaches agents to bypass agent runtime security token-redaction mechanisms (naming Hermes and Claude Code by name), 22+ near-duplicate skill variants appear optimized to maximize activation frequency, and users are directed to create commercial accounts with TranscriptAPI.com without any affiliation disclosure from the ZeroPointRepo publisher. The skill is functionally legitimate but warrants caution around its security-bypass instructions and the undisclosed commercial relationship.
Category Scores
Findings (8)
MEDIUM Auth flow teaches agents to bypass runtime security token-redaction -18 ▶
The auth-setup.md explicitly instructs agents to write HTTP response bodies to temp files rather than letting them pass through tool output. The stated reason is that agent runtimes (Hermes, Claude Code named explicitly) redact values matching patterns like access_token, api_key, and sk_ before the model sees them. While the purpose is to make the legitimate auth flow function, this is a documented security bypass technique: the agent is instructed to move sensitive values out of the monitored output channel and into the filesystem channel. The same pattern could be used to handle exfiltrated data without agent-layer inspection.
LOW Overly broad trigger conditions across 22+ near-duplicate skills -6 ▶
The repository ships 22+ functionally identical skills in two parallel directory trees (clawhub/ and skills/), differentiated only by marginally different trigger descriptions. Several use language like 'even if YouTube is not mentioned explicitly' or 'even if not mentioned' to maximize activation breadth. The transcriptapi skill is described to fire on 'anything where video content is fresher or richer than text search' — an extremely wide net. This redundancy suggests optimization for activation frequency over user intent.
LOW External OpenAPI spec reference could load updated attacker instructions -8 ▶
Multiple SKILL.md files direct agents to fetch transcriptapi.com/openapi.json for 'latest parameters and schemas.' This means the skill can pull live external content into the agent's decision context. If the transcriptapi.com domain were ever compromised or sold, this reference point could be weaponized to inject updated instructions into already-installed skills without requiring a skill update.
LOW TRANSCRIPT_API_KEY stored persistently across agent sessions -4 ▶
The auth-setup.md instructs agents to persistently store the API key 'in future sessions, including non-interactive shells, without any manual sourcing step.' This is standard for API-based skills but means a commercial service credential persists on the user's system indefinitely.
LOW No affiliation disclosure between publisher and commercial API service -15 ▶
The skill is published by ZeroPointRepo and funnels all user activity — including account creation with real email addresses — to TranscriptAPI.com, a paid commercial service (free tier 100 credits, paid plans from $5/mo). No affiliation disclosure or relationship statement exists in the README, CONTRIBUTING.md, or any SKILL.md. Users may not realize they are signing up for a commercial service controlled by a third party unrelated to the Clawhub/skills ecosystem.
INFO 22+ near-duplicate skill variants suggest activation-maximization strategy -5 ▶
The repository ships functionally identical skills under both clawhub/ and skills/ directory trees, plus 10+ variants with different names (yt, transcript, captions, subtitles, youtube-data, youtube-full, transcriptapi, etc.) all wrapping the same single API endpoint. This duplication increases the chance that at least one skill matches any given agent context, maximizing API credit usage.
INFO Clone behavior clean — only GitHub contacted 0 ▶
Installation only contacted GitHub (140.82.121.3:443) as expected for a shallow git clone. Connection diff shows no persistent new connections post-install. No unexpected process spawning or filesystem changes outside the skill directory.
INFO Repository contains only markdown — no code execution risk at install time 0 ▶
The entire repository consists of SKILL.md, auth-setup.md, README.md, CONTRIBUTING.md, .gitignore, LICENSE, and one image file. No executable code, package.json, install hooks, submodules, git hooks, or symlinks were found. There is zero code execution risk during installation.