Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Video Archive Workflow
v1.0.0Video download, metadata extraction, deduplication, subtitle handling, and archive organization for URLs from YouTube/Shorts, Xiaohongshu, Bilibili, and X/Tw...
⭐ 0· 31·0 current·0 all-time
by@feiernk
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md repeatedly cites yt-dlp as the source of truth and describes lossless container conversion (implying ffmpeg or equivalent) and page scraping for tags. However the registry metadata lists no required binaries, no install spec, and no required config paths (e.g., archive root). A video-archiving workflow would legitimately need explicit binaries and a destination path; the omission is incoherent.
Instruction Scope
Instructions remain narrowly focused on parsing URLs, extracting metadata, dedupe logic, tagging, and file/archive handling. They do not ask to read unrelated system files or secret env vars. However they instruct downloading files, converting containers, embedding subtitles, and parsing page HTML — operations that involve network access and filesystem writes and should have explicit guardrails (where to write, permission model, and which tools to run).
Install Mechanism
There is no install specification (instruction-only), which minimizes direct supply-chain risk. But because the workflow depends on external CLI tools/utilities (yt-dlp, ffmpeg or similar) and possibly HTML fetching libraries, the lack of declared install steps or trusted sources is an omission that leaves unclear which binaries will be used and from where.
Credentials
The skill requests no environment variables or credentials, which is proportional given the stated purpose. That said, it also omits any required config (e.g., archive root path, access/permission guidance), which reduces transparency about where files will be stored and what filesystem access is required.
Persistence & Privilege
The skill is not set to always:true and does not declare any persistent privilege. Autonomous invocation is allowed (platform default) but there is no additional persistent presence requested by the skill itself.
What to consider before installing
This skill's instructions clearly expect yt-dlp (for JSON metadata) and a tool for lossless container conversion (e.g., ffmpeg), plus the ability to download files and write archives to disk — but the metadata declares no required binaries, no install steps, and no archive destination. Before installing or enabling this skill, ask the publisher to: (1) explicitly list required binaries (yt-dlp, ffmpeg or equivalent) and their trusted install sources; (2) declare where archive files will be written (a configured archive root path or env var) and what filesystem permissions are needed; (3) clarify whether network access is required and what endpoints will be contacted; and (4) confirm that the agent will prompt before downloading/writing files (the SKILL.md says to download only when asked — verify this behavior). If you cannot get those clarifications, treat the skill as risky: ensure the agent runs in a sandbox with limited filesystem and network permissions, or do not enable autonomous invocation for this skill.Like a lobster shell, security has layers — review code before you run it.
latestvk9783sa33vx57j0ah4tb8d67fd844hvz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.