local-media-cataloger
v1.0.0Index local photos, videos, and creative assets into a searchable manifest with tags, dates, shoot info, and reuse ideas.
⭐ 0· 260·1 current·1 all-time
byvx：17605205782@52yuanchangxing
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name, description, declared dependency (python3), included files, and runtime instructions align with a local media cataloging tool. However, the SKILL.md and README claim extraction of dimensions, duration, tags and generation of reuse ideas; the bundled script only collects basic filesystem metadata (path, filename, ext, size, create/modify times). Generating tags or 'reuse ideas' could be done by the agent (LLM) using the manifest, but the script itself does not extract image dimensions, durations, or embedded metadata (EXIF) as the docs imply.
Instruction Scope
SKILL.md instructs scanning a user-provided folder and using the local script/resource — that is expected. The concern: the script recurses the entire folder tree and will record absolute paths and timestamps for every file under the supplied folder with no file-type filtering by default, which can expose unrelated or sensitive files if the user provides a broad root path. Also there is a mismatch between the described metadata extraction (dimensions/duration/tags) and what the script actually collects.
Install Mechanism
No installation spec — instruction-only skill with a local Python script. This is low risk: nothing is downloaded or written to system locations by an installer. The only runtime dependency declared is python3, which is appropriate and proportional.
Credentials
The skill does not request environment variables, credentials, or external config paths. That is proportionate to a local-only media cataloger. Note that the output CSV contains absolute paths and timestamps which should be treated as sensitive data by the user.
Persistence & Privilege
The skill does not request persistent system presence (always:false) and does not modify other skills or system-wide settings. It writes a manifest file (default media_manifest.csv) to the current working directory when the script is run — expected behavior for this tool.
Assessment
This skill appears to do what it says: it runs a local Python script to produce a manifest. Before installing or running it, do the following: 1) Inspect scripts/media_manifest.py yourself (it's short and readable). 2) Run it on a small, non-sensitive sample folder first (e.g., a test directory) to confirm output format. 3) Be careful to pass the intended media folder path — do NOT point it at root (/) or your whole home directory unless you intend to catalog everything, because the CSV includes absolute paths and timestamps. 4) If you need image/video dimensions, durations, or embedded EXIF tags, note that the bundled script does not extract those; consider extending the script (or using exiftool/ffprobe) before relying on those fields. 5) Keep the generated CSV secure (it may contain sensitive filenames/paths). 6) If you expect the agent to autonomously run this skill, restrict its scope in conversation and avoid granting access to broad filesystem roots. If you want, I can suggest safe command-line changes to add file-type filtering or EXIF extraction.Like a lobster shell, security has layers — review code before you run it.
latestvk97dc83kss8rvgqzxk26scvsr982th92
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🧰 Clawdis
Binspython3