Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Searchables Video Intelligence
v1.0.0YouTube, Bilibili, and local video search, analysis, Q&A, summarization, highlights, and article generation. Use this skill whenever the user mentions YouTub...
⭐ 0· 47·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (video search/analysis) aligns with required binary (curl) and declared env var (SEARCHABLES_API_URL). Requiring a base API URL for a local Searchables service is reasonable. However, the skill treats SEARCHABLES_API_URL as the primary credential (a URL), which could be used to point the agent at an arbitrary remote endpoint if mis-set — this is plausible for the purpose but should be treated as sensitive.
Instruction Scope
The SKILL.md instructs the agent to read ~/.searchables/local-api.json to discover a local API URL (via cat/grep/cut). The skill metadata declared no required config paths, so the instructions reference a filesystem path that wasn't declared — an inconsistency. The instructions also insist all video analysis go through the Searchables API and forbid alternative approaches (e.g., yt-dlp), which is a behavioral constraint but not necessarily malicious. Overall: the skill asks the agent to access a user file and to rely on a local service; the undeclared file access is a mismatch that should be noted.
Install Mechanism
This is an instruction-only skill with no install spec and no code files; the only binary dependency is curl. That is the lowest-risk install footprint (nothing is downloaded or written by the skill itself).
Credentials
Only one environment variable is required (SEARCHABLES_API_URL), which is appropriate for an API-driven skill. However, that env var is a URL (treated as the primary credential). If set to a remote host rather than localhost, the agent will call that endpoint and could leak queries or request local file uploads to an attacker-controlled server. The instructions also attempt to read a local config file for a fallback URL; that file access was not declared in the metadata.
Persistence & Privilege
The skill is not always-enabled and is user-invocable; it does not request persistent presence or modify other skills. Autonomous invocation is allowed (default) but is not combined with other high-risk flags here.
What to consider before installing
What to consider before installing:
- Understand what the skill will call: it expects a Searchables agent accessible at SEARCHABLES_API_URL (defaulting to http://127.0.0.1:37622 if unset). Confirm you trust the Searchables desktop app and its local API before enabling the skill.
- Check the fallback config file: the SKILL.md reads ~/.searchables/local-api.json to discover a base URL but the skill metadata doesn't declare that config path — inspect that file yourself to see what it contains and whether you are comfortable letting the agent read it.
- Be careful with SEARCHABLES_API_URL: it's effectively a pointer/credential. If you (or an admin) set it to a remote host, the agent will send video queries and possibly file data to that host. Only set it to a trusted localhost address unless you intentionally want a remote service.
- The skill forbids using other tools (yt-dlp, direct subtitle downloads) and requires all analysis go through the Searchables API. If you rely on other tooling or want to avoid the desktop app reading browser cookies (used by Searchables to access private/age-restricted content), this skill will change how video data is accessed.
- Because this is instruction-only and uses curl to call local HTTP endpoints, there is no code installed by the skill itself — but the local API it calls could perform actions on your behalf (including using browser cookies). Confirm the Searchables app behavior and permissions before use.
- If you want to proceed: verify the local API is running (curl {baseUrl}/agent-api/health), inspect the local config file, and consider only enabling the skill when you actively need it. If you have concerns about sending data outside your machine, do not set SEARCHABLES_API_URL to an external host and avoid processing sensitive local videos through this skill.Like a lobster shell, security has layers — review code before you run it.
latestvk9705r54x0z65kzc3t6cp9067983g4jt
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🔍 Clawdis
Binscurl
EnvSEARCHABLES_API_URL
Primary envSEARCHABLES_API_URL