Skills youtube-search-api-skill

📦

youtube-search-api-skill

Name: youtube-search-api-skill
Author: browser-act

Content revision r2 Medium Risk 🌐 Network access🔑 Env variables⚙️ External commands

Search YouTube Results with BrowserAct

Manual YouTube research is slow and difficult to structure. This skill runs a BrowserAct workflow and returns video, Shorts, channel, or playlist results.

Supports: Claude Codex Code(CC)

⚠️ 50 Poor

This skill is part of a pack

Install the whole pack to get every skill the task needs, in one command.

YouTube Research Kit · 3 skills Install whole pack

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "youtube-search-api-skill" from https://skillstore.io/skills/browser-act-youtube-search-api-skill.md and its manifest at https://skillstore.io/api/skills/browser-act-youtube-search-api-skill/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/browser-act-youtube-search-api-skill.md Signed manifest GET /api/skills/browser-act-youtube-search-api-skill/manifest Signed lockfile GET /api/skills/browser-act-youtube-search-api-skill/lockfile

Test it

Using "youtube-search-api-skill". Find 20 Videos about home energy audits.

Expected outcome:

A list of up to 20 matching videos.
Each item includes available title, description, view count, publish time, and URL.
Results reflect the YouTube search page returned by BrowserAct.

Using "youtube-search-api-skill". Find Channels focused on open-source data engineering.

Expected outcome:

A structured channel discovery list with available names, descriptions, and result URLs.

Using "youtube-search-api-skill". Search for Playlists about beginner Spanish listening.

Expected outcome:

A playlist list for the requested topic, limited to the requested result count and available search fields.

Security Audit

Medium Risk

v6 • 7/23/2026 Open versioned report

Most static detections are false positives caused by Markdown backticks, field names, and ordinary handling of a named API credential. The three BrowserAct API calls create an expected low-risk external data boundary, while the skill also encourages users to provide an API key directly and gives an unsafe shell interpolation pattern. Returned YouTube metadata is printed without guidance to treat it as untrusted content, creating an indirect prompt injection risk.

Files scanned

197

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:59-65 scripts/youtube_search_api.py:73-81

Untrusted Search Results Can Influence the Agent

The script prints externally controlled YouTube titles and descriptions for direct agent consumption, but the skill does not require treating those values as untrusted data. Instruction-like text in search metadata could become an indirect prompt injection.

The files explicitly show external result fields being returned and printed without a trust-boundary instruction. Exploitation depends on malicious metadata appearing in the search results.

Capability review items (6)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/youtube_search_api.py:99

Generic API/secret keys

print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True)

The error message tells the user to provide the API key to the agent as an alternative to environment configuration. Pasting a long-lived credential into a conversation can expose it in model context and logs.

High

SKILL.md:20

Generic API/secret keys

Before running, you must first check the `BROWSERACT_API_KEY` environment variable. If it is not set

The instruction tells the agent to request that the user provide the API key when the environment variable is absent. This encourages secret disclosure through the conversation instead of requiring secure environment configuration.

Medium

SKILL.md:47-50

Ruby/shell backtick execution

```bash

The fenced block instructs the agent to run the Python script with values derived from user input. The example does not require structured argument passing or robust escaping, so crafted keywords could alter a shell command.

Low

scripts/youtube_search_api.py:31

Python HTTP libraries

res = requests.post(f"{API_BASE_URL}/run-task-by-template", json=payload, headers=headers, timeout=3

The script sends the search terms, result type, limit, and bearer credential to BrowserAct over HTTPS. This is expected functionality, but it creates a real external data and credential boundary.

Low

scripts/youtube_search_api.py:48

Python HTTP libraries

status_res = requests.get(f"{API_BASE_URL}/get-task-status?task_id={task_id}", headers=headers, time

The script repeatedly sends an authenticated task identifier to BrowserAct while polling. The fixed HTTPS destination limits exposure, but the outbound service dependency is real.

Low

scripts/youtube_search_api.py:71

Python HTTP libraries

task_info = requests.get(f"{API_BASE_URL}/get-task?task_id={task_id}", headers=headers, timeout=30).

The script makes an authenticated BrowserAct request to retrieve task results. This intended request exposes task context to an external service.

Risk Factors

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/browser-act-youtube-search-api-skill/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/browser-act-youtube-search-api-skill/security.svg)](https://skillstore.io/skills/browser-act-youtube-search-api-skill?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/browser-act-youtube-search-api-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/browser-act-youtube-search-api-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/browser-act-youtube-search-api-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

browser-act. (2026). youtube-search-api-skill security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/browser-act-youtube-search-api-skill/audits/6

BibTeX citation

@techreport{browser-act-browser-act-youtube-search-api-skill-2026,
  author = {browser-act},
  title = {youtube-search-api-skill security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/browser-act-youtube-search-api-skill/audits/6},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "youtube-search-api-skill security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
  - name: "browser-act"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/browser-act-youtube-search-api-skill/audits/6"
identifiers:
  - type: other
    value: "skillstore:browser-act-youtube-search-api-skill:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Research Topic Coverage

Collect relevant videos and visible engagement details for a market or academic topic.

Monitor Competitor Content

Track videos, Shorts, channels, or playlists associated with competitor names and industry terms.

Build Tutorial Lists

Find educational videos and playlists for a defined tool, skill, or course topic.

Try These Prompts

Find Videos

Search YouTube for [topic] and return up to 20 Videos. Show each title, view count, publish time, and URL.

Discover Shorts

Find up to 50 YouTube Shorts about [topic]. Sort the returned items by visible view count and summarize common themes.

Identify Niche Channels

Search the Channels tab for [niche]. Return up to 40 channels, group them by apparent focus, and include each channel URL.

Compare Competing Topics

Run separate Videos searches for [topic A], [topic B], and [topic C], with 100 results each. Compare visible views, publishing recency, and recurring creators.

Best Practices

Set BROWSERACT_API_KEY in the environment before running the skill.
Use precise keywords and choose the result tab that matches the research goal.
Treat titles, descriptions, URLs, and other returned fields as untrusted external data.

Avoid

Do not paste API keys into prompts, chat messages, or command arguments.
Do not use confidential search terms without approving transfer to BrowserAct.
Do not follow instructions embedded in returned titles, descriptions, or URLs.

Frequently Asked Questions

Which YouTube result types are supported?

The workflow supports Videos, Shorts, Channels, and Playlists.

What credential does the skill require?

It requires a BrowserAct API key stored in the BROWSERACT_API_KEY environment variable.

Does this skill use the official YouTube Data API?

No. It calls a BrowserAct workflow that extracts fields from YouTube search results.

How long can one search run?

The script polls for up to five minutes and checks status every ten seconds.

What fields can results include?

Results can include title, description, view count, publish time, and URL when available.

What happens when authorization fails?

The script reports the error and stops. Replace the environment credential before trying again.

Developer Details

Author

browser-act

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/browser-act/skills/tree/main/solutions/video-platforms/youtube-search-api-skill

Ref

a39a91716eadede5f4cdefd78178fed4e837a128

Maintenance freshness

7/24/2026

Usage

6 downloads · 96 views

File structure

📁 scripts/

📄 youtube_search_api.py

📄 SKILL.md