Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Yt2bb
v2.5.0Use when the user wants to repurpose a YouTube video for Bilibili, add bilingual (English-Chinese) subtitles to a video, or create hardcoded subtitle version...
⭐ 1· 110·0 current·0 all-time
byAgents365.ai@agents365-ai
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (YouTube→Bilibili, EN↔ZH subtitles) lines up with required binaries and included code: yt-dlp (download), whisper (transcribe), srt_utils.py (subtitle processing), ffmpeg (burn-in). Required tools and scripts are appropriate and expected for the declared workflow.
Instruction Scope
SKILL.md keeps to the stated pipeline (download → transcribe → translate → merge → burn → generate metadata). It also: (a) searches common agent skill directories to find SKILL_DIR and runs a git fetch to check for updates (it does not auto-pull), and (b) uses yt-dlp with --cookies-from-browser chrome which reads browser cookie stores to enable downloading content requiring login. Both behaviors are coherent with the purpose but worth noting because they touch local browser data and the filesystem locations of other agent skills.
Install Mechanism
Install entries are standard package installs (brew/apt for ffmpeg, pip for yt-dlp and openai-whisper). No arbitrary URL downloads, no extract-from-unknown-host steps. The shipped Python script (srt_utils.py) is included in the repo and visible for review.
Credentials
The skill declares no required environment variables or external credentials (correct). However, yt-dlp usage documented relies on extracting Chrome cookies from the local browser profile to access age-restricted/private videos — this is functionally necessary for some downloads but does imply access to local browser auth data. Also translation/publish metadata steps are left to the agent (AI), which may be a remote model call depending on how your agent is configured.
Persistence & Privilege
always:false and user-invocable:true (normal). The only cross-repository/system actions are a read/search for SKILL_DIR and a conditional git fetch; the skill does not auto-pull or modify other skills or system-wide configs.
Assessment
This skill is internally consistent with its stated purpose, but review these practical considerations before installing:
- It uses yt-dlp with --cookies-from-browser chrome: running the download step may read your Chrome cookie store to access private/age-restricted videos. If you don't want the skill to access browser cookies, avoid that flag or supply an explicit cookie file.
- The translation/publish metadata step is performed by the agent/AI — that may invoke a remote model/service depending on your agent configuration, so be mindful of what text (transcripts, video content) you allow the agent to send externally.
- The repo contains a large Python CLI (srt_utils.py) and a shell preview script; both are local and readable—inspect them if you want to verify behavior. There are no hidden network sinks or arbitrary remote downloads in the install spec.
- yt-dlp, whisper (openai-whisper), and ffmpeg are powerful tools: only use binaries from trusted sources and keep them up to date.
- Consider copyright/legal implications of downloading and republishing YouTube content to other platforms.
If you want stronger containment: run the skill in an environment without Chrome login or remove the --cookies-from-browser usage, and ensure your agent's model invocation settings restrict remote calls or logging of sensitive transcripts.Like a lobster shell, security has layers — review code before you run it.
latestvk977bc9wc66nmr7ntamhwbvh4184npms
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
OSmacOS · Linux · Windows
Binspython3, ffmpeg, yt-dlp, whisper
Install
Install ffmpeg via Homebrew
Bins: ffmpeg
brew install ffmpegInstall yt-dlp via Homebrew
Bins: yt-dlp
brew install yt-dlp