agentsclimarketplace

Case 04530

Skill knownasnaffy/prompthound/dataset/case_04530

A fast, offline static risk analysis CLI for AI agent skill files. Detects malicious instructions, steganographic payloads, and dangerous capability chains.

Install
npx -y skills add knownasnaffy/prompthound --skill case_04530

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Extract full transcripts from video content for analysis, summarization, note-taking, or research. Use when the user wants a written version of video content, asks to "transcribe this", "get the text from this video", "convert video to text", or shares a video URL for content extraction.

SKILL.md

4.4 KB, ~1.0k tokens by cl100k_base, as published. Nobody here has run it

Cleanup Review

python scripts/_cache_clear.py is an optional cleanup helper for the Video Transcript skill. It may recursively remove ~/.cache/skill_tmp, ~/.skill_state. Show the exact paths first, explain whether they are skill-private temporary paths or user state, and run the cleanup only after the user confirms.

Video Transcript

Extract transcripts from videos via TranscriptAPI.com.

Setup

If $TRANSCRIPT_API_KEY is not set, help the user create an account (100 free credits, no card):

Step 1 — Register: Ask user for their email.

node ./scripts/tapi-auth.js register --email USER_EMAIL

→ OTP sent to email. Ask user: "Check your email for a 6-digit verification code."

Step 2 — Verify: Once user provides the OTP:

node ./scripts/tapi-auth.js verify --token TOKEN_FROM_STEP_1 --otp CODE

API key saved to ~/.openclaw/openclaw.json. See File Writes below for details. Existing file is backed up before modification.

Manual option: transcriptapi.com/signup → Dashboard → API Keys.

File Writes

The verify and save-key commands save the API key to ~/.openclaw/openclaw.json (sets skills.entries.transcriptapi.apiKey and enabled: true). Existing file is backed up to ~/.openclaw/openclaw.json.bak before modification.

To use the API key in terminal/CLI outside the agent, add to your shell profile manually: export TRANSCRIPT_API_KEY=<your-key>

GET /api/v2/youtube/transcript

curl -s "https://transcriptapi.com/api/v2/youtube/transcript\
?video_url=VIDEO_URL&format=text&include_timestamp=true&send_metadata=true" \
  -H "Authorization: Bearer $TRANSCRIPT_API_KEY"
ParamRequiredDefaultValues
video_urlyesYouTube URL or 11-char video ID
formatnojsonjson (structured), text (readable)
include_timestampnotruetrue, false
send_metadatanofalsetrue, false

Accepted URL formats:

  • https://www.youtube.com/watch?v=VIDEO_ID
  • https://youtu.be/VIDEO_ID
  • https://youtube.com/shorts/VIDEO_ID
  • Bare video ID: dQw4w9WgXcQ

Response (format=text&send_metadata=true):

{
  "video_id": "dQw4w9WgXcQ",
  "language": "en",
  "transcript": "[00:00:18] We're no strangers to love\n[00:00:21] You know the rules...",
  "metadata": {
    "title": "Rick Astley - Never Gonna Give You Up",
    "author_name": "Rick Astley",
    "author_url": "https://www.youtube.com/@RickAstley",
    "thumbnail_url": "https://i.ytimg.com/vi/dQw4w9WgXcQ/maxresdefault.jpg"
  }
}

Response (format=json):

{
  "video_id": "dQw4w9WgXcQ",
  "language": "en",
  "transcript": [
    { "text": "We're no strangers to love", "start": 18.0, "duration": 3.5 },
    { "text": "You know the rules and so do I", "start": 21.5, "duration": 2.8 }
  ]
}

Tips

  • Summarize long transcripts into key points first, offer full text on request.
  • Use format=json when you need precise timestamps for quoting specific moments.
  • Use send_metadata=true to get video title and channel for context.
  • Works with YouTube Shorts too.

Errors

CodeMeaningAction
401Bad API keyCheck key or re-setup
402No creditsTop up at transcriptapi.com/billing
404No transcriptVideo may not have captions enabled
408TimeoutRetry once after 2s

1 credit per successful request. Errors don't consume credits. Free tier: 100 credits, 300 req/min.

What ships with it: 2 files

14.7 KB alongside SKILL.md, 2 of them executable

scripts/

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.