Video Summarizer（视频摘录+Notion存档）

This skill is largely consistent with its description, but there are a few things to consider before installing: - Secrets and external APIs: The skill requires your DashScope AI API key and your Aliyun OSS access key/secret (and bucket). Using it will send transcripts and screenshots to external services (DashScope, Siliconflow, Aliyun). Only use keys you trust and be aware those services will receive video/audio/text content. - Missing/mismatched env var: The scripts expect ALIYUN_OSS_ENDPOINT (and other optional keys) though ALIYUN_OSS_ENDPOINT isn't listed in the registry's required env list — make sure to set ALIYUN_OSS_ENDPOINT in ~/.openclaw/.env or the check will fail. - Cookies and session data: Bilibili login saves converted cookies to ~/.cookies/bilibili_cookies.txt (contains session tokens). Only perform the login flow on a machine you control and be prepared to rotate session credentials if needed. - Review external endpoints: The skill calls dashscope.aliyuncs.com and other third-party endpoints (e.g., siliconflow.cn), and scrapes video sites. If you do not trust those endpoints, do not provide keys or do not run the skill. - Least privilege & isolation: Create an OSS bucket with limited scope (e.g., dedicated bucket, minimal permissions) and avoid using sensitive workspace keys. Consider running the skill in an isolated environment (container/VM) if you run untrusted videos or credentials. - Verify optional dependencies: The repo uses biliup for Bilibili login and other Python libs; ensure you install only what you need. The SKILL.md/pip instructions mention requests/oss2/python-dotenv but biliup is referenced by scripts — install it intentionally if you need Bilibili subtitle access. - If you need stronger assurance: inspect the remaining omitted files (upload-to-oss.py, video-summarize.sh, transcribe scripts, push-to-notion.py) in full, and run the scripts in a test environment with non-production keys first. If you want, I can: (1) point out exact lines where sensitive network calls happen, (2) list all environment variables the scripts actually read, or (3) produce a minimal safe configuration example (scoped OSS bucket + non-production AI key) for testing.