Extract YouTube video transcripts from existing captions (manual or auto-generated) using yt-dlp, with optional timestamps and local SQLite caching. Use when...
Security Analysis
high confidenceThe skill is internally consistent with its stated purpose: it uses yt-dlp (and a YouTube transcript fallback) to extract captions, asks for no unrelated credentials, and limits cookie/cache paths.
Name/description (YouTube transcript via yt-dlp) matches the actual requirements and behavior: the skill requires python3 and yt-dlp, validates inputs as YouTube URLs/IDs, prefers manual captions then auto captions, and caches results. No unrelated binaries, env vars, or credentials are requested.
SKILL.md instructions stay within scope: they only instruct running the provided script, optionally supplying a cookies file or env var for authenticated YouTube access, and explicitly warn against forwarding arbitrary flags or publishing cookies. The runtime instructions and the script focus on YouTube and local caching; they do not ask to read unrelated files or send data to third-party transcript providers.
There is no install spec (instruction-only with an included script). That reduces supply-chain risk. The script relies on system yt-dlp and python3 rather than fetching arbitrary remote code during install.
No required environment variables or credentials are declared. The only optional secret is cookies (YT_TRANSCRIPT_COOKIES), which is appropriate for accessing authenticated YouTube sessions. Cookies are handled as secrets and the code filters cookie entries to YouTube/Google domains.
The skill is not always-enabled (always:false) and does not declare elevated privileges. It writes a local SQLite cache and supports storing cookies under ~/.config/yt-transcript/ or {baseDir}/cache/, which is reasonable for a caching/transcript tool. Note: writing cache files into {baseDir}/cache can cause artifacts inside the skill directory if the agent's baseDir is a location that gets published—SKILL.md warns about this.
Guidance
This skill appears to do what it claims: extract YouTube captions using yt-dlp and an optional YouTube transcript-panel fallback. Before installing, ensure you have yt-dlp on PATH and understand that the script will contact YouTube (network access) and write a local cache (default {baseDir}/cache/transcripts.sqlite or ~/.config/yt-transcript/). If you need authenticated access on restricted IPs, provide a cookies.txt file in Netscape format and keep it outside the skill folder (e.g., ~/.config/yt-transcript/) because cookies are secrets and can be mispublished. Finally, review and approve running subprocesses (yt-dlp) in your environment since the script invokes yt-dlp and performs HTTP requests to YouTube.
Latest Release
v1.0.5
Metadata: make cookies env var optional (not required). Clarify cookie handling; no auto-load from skill dir.
More by @ItzSubhadip
Published by @ItzSubhadip on ClawHub
