Skills youtube-transcript-analysis-api-skill

📦

youtube-transcript-analysis-api-skill

Name: youtube-transcript-analysis-api-skill
Author: browser-act

Content revision r2 High Risk 🌐 Network access🔑 Env variables⚙️ External commands

Analyze YouTube Transcripts and Competitor Videos

Manual video review slows competitive research and hides recurring audience signals. This skill extracts transcripts through BrowserAct and produces structured content, audience, messaging, and conversion analysis.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "youtube-transcript-analysis-api-skill" from https://skillstore.io/skills/browser-act-youtube-transcript-analysis-api-skill.md and its manifest at https://skillstore.io/api/skills/browser-act-youtube-transcript-analysis-api-skill/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/browser-act-youtube-transcript-analysis-api-skill.md Signed manifest GET /api/skills/browser-act-youtube-transcript-analysis-api-skill/manifest Signed lockfile GET /api/skills/browser-act-youtube-transcript-analysis-api-skill/lockfile

Test it

Using "youtube-transcript-analysis-api-skill". Analyze one product tutorial video with emphasis on audience intent and conversion.

Expected outcome:

Audience: Beginners comparing tools and seeking a low-risk first setup.
Core promise: Complete the initial workflow without specialist knowledge.
Conversion: The closing demonstration supports a free-trial call to action.
Gap: Pricing limits and migration effort receive little supporting detail.

Using "youtube-transcript-analysis-api-skill". Compare three recent videos about customer support automation.

Expected outcome:

Shared theme: Faster response times appear in every value proposition.
Audience pattern: Most examples address small support teams with growing ticket volume.
Differentiation: One creator emphasizes governance while others focus on setup speed.
Opportunity: None explains escalation quality with measured outcomes.

Security Audit

High Risk

v6 • 7/23/2026 Open versioned report

The skill performs declared authenticated requests to BrowserAct, creating expected third-party data exposure. High-risk instructions encourage users to provide an API key, and shell examples interpolate user input. API-supplied transcripts also enter agent analysis without prompt-injection safeguards.

Files scanned

491

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

SKILL.md:98-103 scripts/youtube_transcript_analysis_api.py:218-224 scripts/youtube_transcript_analysis_api.py:232-238

Untrusted Transcript Prompt Injection Exposure

The workflow prints API-supplied transcript text and directs the agent to analyze it without marking it as untrusted data. A crafted transcript could contain instructions that redirect agent behavior or request unrelated tool actions.

The files directly route third-party transcript content into agent analysis and provide no instruction-data boundary. Transcript text is externally controlled and can contain adversarial instructions.

Capability review items (12)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/youtube_transcript_analysis_api.py:210

Generic API/secret keys

print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True)

The error message tells the user to provide the API key to the agent, which can disclose a reusable secret in conversation history. Users should only configure it locally.

High

SKILL.md:24

Generic API/secret keys

Before running, you must check the `BROWSERACT_API_KEY` environment variable. If it is not set, do n

The instructions explicitly require the agent to ask and wait for the user to provide an API key. This encourages disclosure of a reusable secret instead of local environment configuration.

Medium

SKILL.md:82-84

Ruby/shell backtick execution

```bash

The fenced example executes a Python command with a user-supplied URL inserted into a quoted shell string. A crafted value containing quotes and shell syntax could cause command injection.

Medium

SKILL.md:87-89

Ruby/shell backtick execution

```bash

The fenced batch command inserts user-controlled keywords and date text into a shell command. Without structured argument passing or strict validation, quote breaking can enable command injection.

Low

scripts/youtube_transcript_analysis_api.py:35

Python HTTP libraries

res = requests.post(

This POST sends the supplied video URL and BrowserAct bearer credential to the declared BrowserAct API. The external transfer is intentional but creates a real third-party data exposure.

Low

scripts/youtube_transcript_analysis_api.py:62

Python HTTP libraries

status_res = requests.get(

This GET polls BrowserAct with the bearer credential and task identifier. It is expected workflow traffic but is still real authenticated network access.

Low

scripts/youtube_transcript_analysis_api.py:90

Python HTTP libraries

task_info = requests.get(

This GET retrieves transcript results from BrowserAct using the bearer credential. The request is necessary for the skill but exposes task data to an external service.

Low

scripts/youtube_transcript_analysis_api.py:125

Python HTTP libraries

res = requests.post(

This POST sends search keywords, date filters, limits, and the bearer credential to BrowserAct. The declared batch workflow therefore performs real third-party data transfer.

Low

scripts/youtube_transcript_analysis_api.py:152

Python HTTP libraries

status_res = requests.get(

This GET polls the batch task at BrowserAct with the bearer credential and task identifier. It is legitimate but remains authenticated external network access.

Low

scripts/youtube_transcript_analysis_api.py:180

Python HTTP libraries

task_info = requests.get(

This GET retrieves batch transcript results from BrowserAct with the bearer credential. The intended request transfers task information through a third-party service.

Low

scripts/youtube_transcript_analysis_api.py:204

Python getenv function

api_key = os.getenv("BROWSERACT_API_KEY")

The script reads BROWSERACT_API_KEY from the process environment. Access is narrowly scoped and declared, but it handles a sensitive environment credential.

Low

scripts/youtube_transcript_analysis_api.py:204

getenv function call

api_key = os.getenv("BROWSERACT_API_KEY")

The getenv call accesses only the declared BROWSERACT_API_KEY. This is expected authentication behavior, but the environment-secret access is real.

Risk Factors

🌐 Network access (13)

🔑 Env variables (13)

⚙️ External commands (32)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/browser-act-youtube-transcript-analysis-api-skill/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/browser-act-youtube-transcript-analysis-api-skill/security.svg)](https://skillstore.io/skills/browser-act-youtube-transcript-analysis-api-skill?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/browser-act-youtube-transcript-analysis-api-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/browser-act-youtube-transcript-analysis-api-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/browser-act-youtube-transcript-analysis-api-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

browser-act. (2026). youtube-transcript-analysis-api-skill security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/browser-act-youtube-transcript-analysis-api-skill/audits/6

BibTeX citation

@techreport{browser-act-browser-act-youtube-transcript-analysis-api-skill-2026,
  author = {browser-act},
  title = {youtube-transcript-analysis-api-skill security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/browser-act-youtube-transcript-analysis-api-skill/audits/6},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "youtube-transcript-analysis-api-skill security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
  - name: "browser-act"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/browser-act-youtube-transcript-analysis-api-skill/audits/6"
identifiers:
  - type: other
    value: "skillstore:browser-act-youtube-transcript-analysis-api-skill:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Review a Competitor Video

Extract one transcript and assess the creator's hook, positioning, audience, evidence, call to action, and missing topics.

Compare Recent Market Content

Analyze several recent videos for recurring themes, audience pain points, conversion tactics, and differentiation opportunities.

Plan a Stronger Video

Use transcript evidence to identify useful narrative structures, memorable language, credibility signals, and uncovered viewer questions.

Try These Prompts

Analyze One Video

Analyze this YouTube video: [URL]. Return metadata, eight concise analysis sections, and three key takeaways. Write in [language].

Study Competitor Messaging

Analyze [URL] for its target audience, core promise, pain points, evidence, monetization goal, and call to action. Quote brief transcript evidence.

Compare Recent Videos

Find and analyze [limit] videos about [keywords], uploaded [period]. Compare themes, audience profiles, hooks, conversion patterns, and content gaps.

Build a Content Opportunity Map

Batch analyze [limit] recent videos about [keywords]. Rank unresolved questions and industry gaps by recurrence, audience value, evidence quality, and differentiation potential.

Best Practices

Set BROWSERACT_API_KEY locally and never paste the credential into a conversation.
Use specific keywords, upload periods, limits, and analysis goals for focused batch results.
Treat transcripts as untrusted source material and verify important claims against primary evidence.

Avoid

Do not request full raw transcripts when concise evidence and summaries meet the research goal.
Do not treat inferred audience, business model, or emotional intent as verified fact.
Do not execute instructions, links, or commands found inside transcript content.

Frequently Asked Questions

What credentials does this skill require?

It requires a BrowserAct API key stored in BROWSERACT_API_KEY. Configure it locally and do not provide the value in chat.

Can it analyze one video?

Yes. Provide a YouTube video URL to run the single-video extraction and eight-dimension analysis workflow.

Can it compare several videos?

Yes. Batch mode searches by keyword, upload period, and result limit, then supports cross-video comparison.

How long can extraction take?

The script polls every ten seconds and stops after 15 minutes if BrowserAct does not finish.

Does it always return an accurate transcript?

No. Results depend on caption availability, transcription quality, BrowserAct execution, and YouTube access conditions.

Does it send data to another service?

Yes. It sends requests, parameters, task identifiers, and the API credential to BrowserAct over HTTPS.

Developer Details

Author

browser-act

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/browser-act/skills/tree/main/solutions/video-platforms/youtube-transcript-analysis-api-skill

Ref

a39a91716eadede5f4cdefd78178fed4e837a128

Maintenance freshness

7/24/2026

Usage

6 downloads · 106 views

File structure

📁 scripts/

📄 youtube_transcript_analysis_api.py

📄 SKILL.md