Extract subtitles/transcripts from YouTube videos. Triggers: "youtube transcript", "extract subtitles", "video captions", "视频字幕", "字幕提取", "YouTube转文字", "提取字幕".
Security Analysis
medium confidenceThe skill's requested actions (yt-dlp and browser automation) match its stated purpose of extracting YouTube transcripts; no unrelated credentials or installers are requested, though there are small inconsistencies and privacy-relevant behaviors you should be aware of.
The skill's name and description align with its instructions: it uses yt-dlp when available and falls back to browser automation to extract transcripts. Minor inconsistency: SKILL.md mentions using 'WebFetch' or 'firecrawl' to fetch the page/title, but those tools are not listed in the allowed-tools block. Otherwise the declared allowed tools (yt-dlp and the chrome-devtools mcp plugin) are appropriate for the stated purpose.
Instructions stay focused on extracting transcripts and saving them locally. Privacy-relevant behaviors: recommending yt-dlp with --cookies-from-browser=chrome means the tool will read browser cookie stores to bypass sign-in restrictions; the mcp__plugin evaluate_script step runs arbitrary JS on the video page (reads DOM/transcript). These are coherent for scraping transcripts but can expose local browser cookies or other page content if the environment/tool implementation is broad.
No install spec (instruction-only), so nothing is being downloaded or written by the skill itself. This is low-risk from an install perspective.
The skill does not request environment variables, credentials, or config paths. It does rely on local tools (yt-dlp and a chrome-devtools mcp plugin) and on access to the browser's cookie store via yt-dlp, which is proportional to the goal but privacy-sensitive; no extra unrelated credentials are requested.
always is false and the skill is user-invocable. It does not request permanent presence or modifications to other skills or system-wide settings.
Guidance
This skill appears to do what it says: extract YouTube transcripts using yt-dlp or browser automation. Before installing, consider: (1) yt-dlp --cookies-from-browser will access your browser cookie store to handle sign-in-protected videos — only proceed if you are comfortable with that and trust the runtime. (2) The fallback uses a chrome-devtools plugin to open pages and run JavaScript on them; review what that plugin can access in your environment. (3) SKILL.md mentions 'WebFetch'/'firecrawl' but those tools aren't declared — if the agent attempts those, verify what implementation will be used. (4) No external credentials are requested and nothing is downloaded by the skill itself, which reduces risk. If you plan to use this skill, ensure yt-dlp and/or the specified mcp plugin are installed from trusted sources and avoid running it in environments where exposing browser cookies would be unacceptable.
Latest Release
v0.1.0
youtube-transcribe-skill v0.1.0 - Initial release: Extracts subtitles/transcripts from YouTube videos via CLI or browser automation. - Supports multiple triggers, including English and Chinese phrases. - Primary extraction uses `yt-dlp`; if unavailable or fails, falls back to browser automation via `chrome-devtools-mcp`. - Handles common issues (missing tools, browser restrictions) with user prompts and fallbacks. - Saves extracted subtitles to the current directory with timestamp and subtitle text per line. - Reports file path, subtitle language, and total subtitle lines upon completion.
More by @feiskyer
Published by @feiskyer on ClawHub
