Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

music-manager

v1.0.0

通用音乐下载管理器。支持从YouTube/Bilibili搜索下载音乐,自动转MP3,按分类存入本地音乐库

0· 351·2 current·2 all-time
byThou@2771096196

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for 2771096196/music-manager.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "music-manager" (2771096196/music-manager) from ClawHub.
Skill page: https://clawhub.ai/2771096196/music-manager
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install 2771096196/music-manager

ClawHub CLI

Package manager switcher

npx clawhub@latest install music-manager
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
Name/description (download music from YouTube/Bilibili, convert to MP3, save by category) matches the included script and instructions. The script constructs yt-dlp arguments, writes files into a user-configurable MUSIC_DIR, and uses browser cookies optionally for logged-in downloads — all coherent with the stated purpose.
Instruction Scope
SKILL.md instructs editing the script to set MUSIC_DIR and optionally enabling cookie extraction from the local browser. That scope is expected for this task, but the cookie-extraction step is sensitive because it causes yt-dlp to read browser cookies (session tokens) from the user's browser profiles. The instructions also assume macOS-style install commands (brew) and do not provide alternatives for other OSes.
Install Mechanism
There is no install spec for the skill itself (instruction-only plus a small Python script). The README suggests using brew to install yt-dlp and ffmpeg — that’s a normal, low-risk recommendation, though platform-specific. The skill does not download or execute remote code itself.
Credentials
The skill does not request environment variables or external credentials. The only sensitive capability is optional browser cookie extraction (triggered by setting BROWSER), which is proportionate for accessing age-restricted/private content but should be considered sensitive because it exposes browser session cookies to yt-dlp.
Persistence & Privilege
The skill is not always-enabled and can only be invoked by the user or the agent per normal rules. It does not request persistent system privileges or modify other skills/configuration.
Assessment
This skill appears to do what it claims: it runs a local Python script that calls yt-dlp to download and ffmpeg to convert audio. Before installing or running it, consider: (1) Browser cookies: enabling cookie extraction (BROWSER set to e.g. 'chrome') gives yt-dlp access to your browser session cookies — only enable this if you understand the privacy risk and trust yt-dlp on your machine. (2) Installation source: follow official install instructions for yt-dlp and ffmpeg (official releases or package manager) rather than untrusted downloads. (3) MUSIC_DIR: set the MUSIC_DIR to a directory you control to avoid overwriting important files. (4) Platform: SKILL.md uses brew (macOS); adapt install commands for Linux/Windows as appropriate. (5) Legality: downloading copyrighted content may violate terms or law in your jurisdiction — ensure you have rights to the media you fetch. If you want extra caution, run the script in an isolated environment (VM/container) and avoid enabling cookie extraction unless necessary.

Like a lobster shell, security has layers — review code before you run it.

latestvk971z3p1sq2fzystcf92wgwt1x82hrpe
351downloads
0stars
1versions
Updated 6h ago
v1.0.0
MIT-0

Music Manager

通用音乐下载管理工具,支持从 YouTube/Bilibili 下载音频并自动归类。

功能

  • 从 YouTube/Bilibili 搜索并下载音乐
  • 自动转换为 MP3 格式
  • 按分类存入本地音乐库

首次配置

1. 安装依赖

# 安装 yt-dlp(音视频下载工具)
brew install yt-dlp

# 安装 ffmpeg(音视频转换工具)
brew install ffmpeg

2. 配置音乐目录

编辑 scripts/download_music.py,修改配置:

# 你的音乐目录路径
MUSIC_DIR = "~/Music"  # 或 "/你的/音乐/目录"

3. Cookie 配置(可选)

YouTube 下载需要登录权限:

# 方法1:从浏览器自动提取
BROWSER = "chrome"  # 或 safari, firefox

# 方法2:不使用 cookie(可能受限)
BROWSER = None

使用方法

命令行

python3 scripts/download_music.py "<搜索词或URL>" "<分类文件夹>"

示例:

# 搜索并下载歌曲
python3 scripts/download_music.py "周杰伦 稻香" "中文"

# 从 B 站下载视频音频
python3 scripts/download_music.py "https://www.bilibili.com/video/BVxxx" "游戏"

AI Agent 调用

让 AI 帮你下载:

  1. 告诉 AI 想下载什么歌
  2. AI 会先搜索展示结果让你确认
  3. 选择分类后自动下载

命名格式

下载文件自动命名为:歌名-作者-来源.mp3

例如:稻香-周杰伦-youtube.mp3

Comments

Loading comments...