# Youtube

> >-

- **Type:** Skill
- **Install:** `agentstack add skill-agentproto-ts-youtube`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [agentproto](https://agentstack.voostack.com/s/agentproto)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [agentproto](https://github.com/agentproto)
- **Source:** https://github.com/agentproto/ts/tree/main/packages/skill-pack-bureau/src/skills/youtube
- **Website:** https://agentproto.sh

## Install

```sh
agentstack add skill-agentproto-ts-youtube
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# YouTube — recon plan (InnerTube API)

**Internal API:** InnerTube —
`POST https://www.youtube.com/youtubei/v1/?key=&prettyPrint=false`,
body `{ context: , ...params }`. The web app uses this for
everything.

## Config + auth (from the page)

- `INNERTUBE_API_KEY` + `INNERTUBE_CONTEXT` live in `ytcfg`. Read in-page:
  ```js
  ;() => ({
    key: ytcfg.get("INNERTUBE_API_KEY"),
    ctx: ytcfg.get("INNERTUBE_CONTEXT"),
  })
  ```
- Public reads: often work with just key + context (no auth).
- Personalized / write (subscriptions, comments, like): need **SAPISIDHASH**
  auth:
  - `Authorization: SAPISIDHASH _`
    where SAPISID = the `SAPISID` (or `__Secure-3PAPISID`) cookie, origin =
    `https://www.youtube.com`, ts = unix seconds. Compute SHA-1 in-page
    (SubtleCrypto). Also send `X-Goog-AuthUser: 0`, `Origin`, cookies (auto).

In-page fetch:

```js
;async (endpoint, body) => {
  const key = ytcfg.get("INNERTUBE_API_KEY")
  const r = await fetch(
    `/youtubei/v1/${endpoint}?key=${key}&prettyPrint=false`,
    {
      method: "POST",
      headers: {
        "content-type": "application/json" /* + SAPISIDHASH for writes */,
      },
      body: JSON.stringify({
        context: ytcfg.get("INNERTUBE_CONTEXT"),
        ...body,
      }),
    }
  )
  return await r.json()
}
```

## Endpoints to test

| Purpose                             | endpoint                                          | params                             |
| ----------------------------------- | ------------------------------------------------- | ---------------------------------- |
| Channel / home / playlist           | `browse`                                          | `browseId` (channel UC…), `params` |
| Watch page → video + comments token | `next`                                            | `videoId`                          |
| **Comments** (+ who/likes)          | `next` (continuation token from the watch `next`) | `continuation`                     |
| Search                              | `search`                                          | `query`, `params`                  |
| Video metadata                      | `player`                                          | `videoId`                          |
| WRITE: comment                      | `comment/create_comment` / `create_comment_reply` | `createCommentParams`              |
| WRITE: like/dislike                 | `like/like` / `like/dislike` / `like/removelike`  | `target.videoId`                   |
| WRITE: subscribe                    | `subscription/subscribe` / `unsubscribe`          | `channelIds`                       |

## Entity model

`Channel{browseId, title, subscriberCount}` ·
`Video{videoId, title, author, viewCount, likeCount}` ·
`Comment{author, text, likeCount, replyCount}`. Responses are deeply nested
**renderer trees** (`*Renderer`) — walk to the renderer that holds the field
(e.g. `commentRenderer`, `videoRenderer`).

## Capture method

Open youtube.com → read ytcfg (above) → `list_network_requests` for
`/youtubei/v1/` → see the endpoint + the body params + continuation tokens.

## Actions to test (read-first; writes gated)

1. read ytcfg key+context.
2. `search` a topic → videos.
3. `next(videoId)` → video + first comments → **who commented + likes** (→
   graph).
4. `browse(channelId)` → a creator's videos/about.
5. (gated, needs SAPISIDHASH) comment / like / subscribe — explicit confirm.

## Gotchas

- SAPISIDHASH required for any authenticated/write call — compute in-page from
  the SAPISID cookie (SubtleCrypto SHA-1). Read-only public data may skip it.
- Renderer trees are verbose; extract by walking for the specific `*Renderer`.
- Comments come via a continuation token from the `next` response, not a flat
  list.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [agentproto](https://github.com/agentproto)
- **Source:** [agentproto/ts](https://github.com/agentproto/ts)
- **License:** Apache-2.0
- **Homepage:** https://agentproto.sh

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-agentproto-ts-youtube
- Seller: https://agentstack.voostack.com/s/agentproto
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.