Summarize YouTube videos with NO subtitles by doing local ASR (yt-dlp + faster-whisper) and extracting a few screenshot frames via ffmpeg. Use when the user...
Security Analysis
medium confidenceThe skill's code and instructions largely match its stated purpose (local ASR of YouTube videos), but metadata/instruction mismatches and some undeclared environment usage create inconsistencies you should review before installing.
The SKILL.md and the included Python script clearly implement local ASR using yt-dlp, ffmpeg, and faster-whisper which is coherent with the skill name/description. However, the registry metadata claims 'Required binaries: none' and 'Required env vars: none' while the script and README explicitly require yt-dlp and ffmpeg and reference environment variables (WHISPER_MODEL, WHISPER_LANG, WHISPER_COMPUTE, TIMELINE_EVERY). That mismatch between declared requirements and what the skill actually needs is an incoherence.
The SKILL.md instructs the user to install yt-dlp, ffmpeg and to pip install faster-whisper and to run the provided script; the script runs yt-dlp/ffmpeg via subprocess, writes transcript/summary files and extracts frames into the specified output directory. These actions are within the stated scope (local download/transcribe/frames). Concern: the instructions and script read environment variables (WHISPER_*, TIMELINE_EVERY) that are not declared in the skill metadata, and the metadata does not warn that the script will download video/audio to disk—so the runtime behavior is broader than the declared requirements.
There is no automated install spec (user is instructed to manually install brew packages and pip dependencies). This is low-risk compared to arbitrary remote installers. The script itself is included in the package (so code will run locally), but nothing in the repo pulls code from unknown URLs or runs hidden installers.
The skill does not request credentials or secrets and does not contact external non-YouTube endpoints. It does read optional environment variables (WHISPER_MODEL, WHISPER_LANG, WHISPER_COMPUTE, TIMELINE_EVERY) as configuration defaults; these are benign but are not listed in the skill's declared env requirements (metadata says none). No sensitive credentials are requested.
The skill is not always-enabled and is user-invocable. It does not request persistent privileges or modify other skills or system-wide settings. It writes output into the user-specified --out directory only.
Guidance
This skill appears to implement what it promises (local YouTube audio download + local ASR + summary + optional frames) and does not request credentials, but there are a few mismatches to be aware of: the registry metadata claims no required binaries/env vars but the script requires yt-dlp and ffmpeg and reads WHISPER_* and TIMELINE_EVERY environment variables. Before running: (1) inspect the full script yourself (it's included) to confirm no unexpected network calls; (2) run it in a controlled directory (not as root) because it will download media and write files to the specified --out path; (3) ensure you install yt-dlp, ffmpeg, and faster-whisper from reputable sources; (4) be aware of copyright/privacy implications of downloading videos; and (5) confirm that any environment variables you set are only benign configuration (the script does not require secrets). If you want stronger assurance, ask the author to correct the metadata to list required binaries and environment variables.
Latest Release
v0.1.0
Local YouTube summarizer: prefer subtitles, else faster-whisper ASR; output includes link + summary + time-range bullets + 1 frame screenshot.
Popular Skills
Published by @yifany-github on ClawHub
