Video Download Archive

ReviewAudited by ClawScan on May 18, 2026.

Overview

The skill is mostly aligned with its video-download-and-archive purpose, but it automatically calls an unbundled user-specific helper script and writes video metadata plus local paths to a fixed Feishu table.

Review this skill before installing. Make sure the Feishu table is the one you intend to use, understand that video URLs and local file paths will be stored there, and do not run it until the missing hard-coded ytfetch.sh helper is bundled or replaced with reviewed, declared dependencies.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill may fail on most systems, or on a matching system it may run an unreviewed local helper with the video URL and local file access.

Why it was flagged

The reviewed package does not include this helper script, and the path is an absolute user-specific workspace path. When the main script runs, it attempts to execute code outside the reviewed skill artifacts.

Skill content
YTFETCH = "/home/jianhao/.openclaw/workspace/scripts/ytfetch.sh" ... rc, out, err = run([YTFETCH, url])
Recommendation

Bundle the helper script in the skill, call it by a reviewed relative path, declare yt-dlp/ffprobe/helper requirements, and avoid executing files outside the packaged artifact.

What this means

Installing and using the skill can add or modify records in the configured Feishu Bitable using the available Feishu account/tool permissions.

Why it was flagged

The workflow uses delegated Feishu platform authority to create or update records in a Bitable. This matches the stated archive purpose, but it is still third-party account mutation.

Skill content
调用:
- `feishu_bitable_app_table_record.update`

### 若没有记录
调用:
- `feishu_bitable_app_table_record.create`
Recommendation

Confirm the target Feishu table is yours or intended, use the least-privileged Feishu access available, and consider requiring explicit confirmation before record updates.

What this means

People or apps with access to the Feishu table may see what video was downloaded and the local filesystem path where it was stored.

Why it was flagged

The Feishu archive is designed to store the original video URL, download time, full local file path, and optionally the info.json attachment. This is disclosed and purpose-aligned, but it sends potentially private local and viewing-history data to Feishu.

Skill content
- 下载的URL:原始输入 URL
- 下载时间:实际下载完成时间
- 下载地址:本地最终文件完整路径
- info.json (附件):能上传则上传
Recommendation

Review who can access the Feishu Bitable, avoid storing full local paths or attachments if unnecessary, and confirm before archiving sensitive URLs.