Agent skill · Audited from source
transcript
skill · zeropointrepo/youtube-skillsMIT licenceAudited 22 Oct 2026 · source 4c50c37e7438
Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 4c50c37e7438 and found no filesystem, network or shell access and no hard-coded secrets. What it does: Use when the spoken content of a YouTube video is needed — even if not explicitly requested: pasted video links or IDs, requests to summarize, quote, transcribe, translate, fact-check, or extract anything from a video.…
Cite
Cite this page
ModelsAtlas. “transcript (zeropointrepo/youtube-skills)”. Retrieved 22 Oct 2026. https://modelsatlas.com/skills/zeropointrepo/transcript
Trust audit
Audit 0.4.1 · source read 22 Oct 2026
SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 0 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | NA | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 2 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (2)
LOWPrompt injectionreview.misleading_scope · references/auth-setup.md
Do not assume. Check your own documentation or configuration for how environment variables are stored persistently on this platform and in this agent environment.
- Why
- The package goes beyond fetching transcripts by persisting an API key into the machine's environment configuration, which its description does not admit.
- Fix
- rewrite it so the instruction says plainly what it does, and asks the user before it acts
LOWPrivilege escalation / persistencereview.unsafe_action · references/auth-setup.md
You will handle the full signup on the user's behalf. This is a two-step flow: register (which sends an OTP to their email), then verify (which exchanges the OTP for the API key).
- Why
- The agent creates an account on the author's service and collects the user's email plus a verification code to obtain a live API key, a persistent external account created without a clear, explicit consent step.
- Fix
- rewrite it so the instruction says plainly what it does, and asks the user before it acts
Audit 0.4.1 · source sha 4c50c37e7438 · 22 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherzeropointrepo GitHub organizationOwner of the repository this skill is read from
- Source folderzeropointrepo/youtube-skills/clawhub/transcriptThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdict4c50c37e7438A new audit runs when the source changes
- Repository statusNot archivedLast push 1 day ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Use when the spoken content of a YouTube video is needed — even if not explicitly requested: pasted video links or IDs, requests to summarize, quote, transcribe, translate, fact-check, or extract anything from a video.…
---
name: transcript
description: "Use when the spoken content of a YouTube video is needed — even if not explicitly requested: pasted video links or IDs, requests to summarize, quote, transcribe, translate, fact-check, or extract anything from a video. Also use for research or learning when a video is the source. Not for uploads or account management."
version: "1.5.1"
user-invocable: true
compatibility: Requires internet access to reach transcriptapi.com. No additional runtimes or dependencies needed.
required_environment_variables:
- name: TRANSCRIPT_API_KEY
prompt: Your TranscriptAPI key (starts with sk_)
help: Free account at https://transcriptapi.com — 100 credits, no card required. Or let the agent create one for you.
required_for: all API requests
metadata: {"openclaw":{"emoji":"📝","requires":{"env":["TRANSCRIPT_API_KEY"]},"primaryEnv":"TRANSCRIPT_API_KEY","homepage":"https://transcriptapi.com"},"hermes":{"tags":["youtube","transcripts","video","captions","summarization","research","translation"],"category":"media"}}
---
# Transcript
Fetch video transcripts via [TranscriptAPI.com](https://transcriptapi.com).
## Setup
If `$TRANSCRIPT_API_KEY` is not set, read [references/auth-setup.md](references/auth-setup.md) and follow the instructions there to get and store the key.
## Required Headers
Every request needs two headers:
- **Authorization:** `Bearer $TRANSCRIPT_API_KEY`
- **User-Agent:** your agent's name and version if known (e.g. `HermesAgent/0.11.0`, `ClaudeCode/1.0`). Version is optional — agent name alone is fine. Do not omit this header or send a bare default — Cloudflare will return a 403 (error code 1010) and block the request.
## GET /api/v2/youtube/transcript
```bash
curl -s "https://transcriptapi.com/api/v2/youtube/transcript\
?video_url=VIDEO_URL&format=text&include_timestamp=true&send_metadata=true" \
-H "Authorization: Bearer $TRANSCRIPT_API_KEY" \
-H "User-Agent: YourAgent/1.0"
```
| Param | Required | Default | Values |
| ------------------- | -------- | ------- | ------------------------------- |
| `video_url` | yes | — | YouTube URL or 11-char video ID |
| `format` | no | `json` | `json`, `text` |
| `include_timestamp` | no | `true` | `true`, `false` |
| `send_metadata` | no | `false` | `true`, `false` |
Accepts: full URLs (`youtube.com/watch?v=ID`), short URLs (`youtu.be/ID`), shorts (`youtube.com/shorts/ID`), or bare video IDs.
**Default:** Always use `format=text&include_timestamp=true&send_metadata=true` unless user specifies otherwise.
**Response** (`format=json`):
```json
{
"video_id": "dQw4w9WgXcQ",
"language": "en",
"transcript": [
{ "text": "We're no strangers to love", "start": 18.0, "duration": 3.5 },
{ "text": "You know the rules and so do I", "start": 21.5, "duration": 2.8 }
],
"metadata": {
"title": "Rick Astley - Never Gonna Give You Up",
"author_name": "Rick Astley",
"author_url": "https://www.youtube.com/@RickAstley",
"thumbnail_url": "https://i.ytimg.com/vi/dQw4w9WgXcQ/maxresdefault.jpg"
}
}
```
**Response** (`format=text`):
```json
{
"video_id": "dQw4w9WgXcQ",
"language": "en",
"transcript": "[00:00:18] We're no strangers to love\n[00:00:21] You know the rules...",
"metadata": {...}
}
```
## Errors
| Code | Meaning | Action |
| -------- | ---------------- | ---------------------------------------------- |
| 401 | Bad API key | Check key or re-setup |
| 402 | No credits | Top up at transcriptapi.com/billing |
| 403/1010 | Cloudflare block | Add or fix User-Agent header |
| 404 | No transcript | Video may not have captions enabled |
| 408 | Timeout | Retry once after 2s |
| 429 | Rate limited | Wait and retry |
## Tips
- For long videos, summarize key points first, offer full transcript on request.
- Use `format=json` when you need precise timestamps for quoting specific moments.
- Use `include_timestamp=false` for clean text suitable for translation or analysis.
- 1 credit per successful request. Errors don't cost credits.
- Free tier: 100 credits, 300 req/min.Excerpt, first 4,431 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 4c50c37
git clone https://github.com/zeropointrepo/youtube-skills git -C youtube-skills checkout 4c50c37e7438
The author documents no install command, so this uses the repository directly. Our verdict covers commit 4c50c37e7438 only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Claude Code | Mentioned in its text, not tested | Skills for Claude Code · About Claude Code |
| OpenClaw | Mentioned in its text, not tested | Skills for OpenClaw · About OpenClaw |
Audit history
Every audit, every source change
- ✓SAFE B 89 / 100
first audit · source
4c50c37e7438
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/zeropointrepo/transcript/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
zeropointrepo/youtube-skills
Use when YouTube is relevant: pasted video links or IDs, @handles, quick video lookups, summaries, channel latest uploads, topic search, or any request involving YouTube content — even if YouTube is not mentioned…
zeropointrepo/youtube-skills
Use when a YouTube channel is the focus: pasted @handles or channel URLs, requests to browse a creator's uploads, see what a channel has posted recently, search within a channel, or resolve a handle to a channel ID.…
zeropointrepo/youtube-skills
Use when structured YouTube data is needed: pasted video/channel/playlist links, transcripts for analysis, video metadata, channel upload history, search results, or playlist contents — without Google API quotas or…
zeropointrepo/youtube-skills
Use when a YouTube playlist is involved: pasted playlist links or IDs, requests to list playlist videos, browse playlist contents, or work through a playlist for transcripts or research. Also use when the user wants all…
zeropointrepo/youtube-skills
Use when the user wants to find YouTube content on any topic: searching for videos or channels, finding creators who cover a subject, discovering tutorials, talks, or expert discussions, or looking up a channel by name…
zeropointrepo/youtube-skills
Use when YouTube data is needed without Google API quotas or OAuth setup: transcripts, video metadata, channel info, search results, playlists. Triggers on pasted YouTube links, creator names, @handles, topic research,…
Add this badge to your README
[](https://modelsatlas.com/skills/zeropointrepo/transcript/)
<a href="https://modelsatlas.com/skills/zeropointrepo/transcript/"><img src="https://modelsatlas.com/skills/zeropointrepo/transcript/badge.svg" alt="ModelsAtlas: SAFE B"></a>
Questions about transcript
What does the transcript skill do?
Is transcript safe to install?
What can transcript access on my machine?
Which assistants does transcript work with?
How current is this page?
Sources
- github.com/zeropointrepo/youtube-skills/tree/main/clawhub/transc — the audited source at commit 4c50c37e7438 and every finding aboveObserved · 22 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the transcript skill do?
- Is transcript safe to install?
- What can transcript access on my machine?