MediaGo
v1.0.0Download videos from m3u8/HLS streams, Bilibili, and direct URLs using MediaGo. 下载视频、m3u8直播流、B站视频。 Triggers on: download video, 下载视频, 下载这个链接, 帮我下载, m3u8 down...
⭐ 1· 48·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill claims to control a MediaGo instance and its instructions only require a MediaGo URL and optional API key plus a local config file; those are coherent and expected for a downloader that proxies requests to a running MediaGo service.
Instruction Scope
Instructions tell the agent to read/write ~/.mediago-skill.json, perform curl calls to the configured BASE_URL (including /api/downloads and /api/config), and poll every 3s for up to 5 minutes. This stays within the downloader's scope, but it will store any provided API key in plaintext and will send user-supplied URLs to the configured server (which could be local or remote).
Install Mechanism
Instruction-only skill with no install steps or code files — minimal surface area and nothing is written to disk by an installer beyond the config file the skill itself manages.
Credentials
The skill does not request environment variables or platform credentials. It does persist an optional API key in ~/.mediago-skill.json; storing secrets in a plaintext home-file is functional but a privacy risk if the key is sensitive or the host is shared.
Persistence & Privilege
always:false and no system-wide modifications. The skill writes and reads only its own config file (~/.mediago-skill.json), which is normal for this use-case.
Assessment
This skill appears to do what it says: it controls a MediaGo server via HTTP and stores a small config in ~/.mediago-skill.json. Before installing, consider: 1) Only point the skill to MediaGo instances you trust — it will send URLs and (optionally) an API key to that host. 2) The API key is stored in a plaintext file in your home directory; if the key is sensitive, limit file permissions or avoid storing it. 3) Verify you downloaded MediaGo from the official repo (SKILL.md cites a GitHub repo) and don't provide credentials to unknown servers. If you want, inspect ~/.mediago-skill.json after configuration and remove stored keys when no longer needed.Like a lobster shell, security has layers — review code before you run it.
latestvk9741tkgvr5y5e00n0hj7w9g95845vy1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.