Video Captions

PendingStatic analysis audit pending.

Overview

No static analysis result has been recorded yet. Pattern checks will appear here once the artifact has been analyzed.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If used on the wrong file or output path, local media files could be processed or overwritten unintentionally.

Why it was flagged

The skill instructs the agent/user to run local media-processing commands that read video/subtitle files and create rendered outputs.

Skill content
ffmpeg -i video.mp4 -vf "subtitles=video.srt:force_style='FontName=Arial..." output.mp4
Recommendation

Confirm input and output paths before running ffmpeg or whisper commands, and keep original media backups for important projects.

What this means

Installing packages can introduce normal dependency supply-chain risk, even though the packages are relevant to the captioning purpose.

Why it was flagged

The documentation recommends installing external Python packages, but the examples do not pin versions or provide lockfiles.

Skill content
pip install openai-whisper
...
pip install mlx-whisper
...
pip install whisper-timestamped
...
pip install stable-ts
Recommendation

Install dependencies in a virtual environment, prefer trusted package sources, and pin versions for repeatable production workflows.

What this means

Using cloud engines may consume paid API quota and gives the configured provider account authority to process the submitted media.

Why it was flagged

Cloud transcription options require user-provided provider API keys, which can authorize paid account usage.

Skill content
# Requires ASSEMBLYAI_API_KEY
export ASSEMBLYAI_API_KEY=your_key
Recommendation

Only configure the API keys you intend to use, monitor provider usage, and avoid placing secrets in shared chat transcripts or reusable files.

What this means

Private audio or video content could leave the local machine if the user chooses a cloud transcription workflow.

Why it was flagged

The optional Deepgram workflow sends the media file to an external transcription provider.

Skill content
curl -X POST "https://api.deepgram.com/v1/listen?model=nova-2" ... --data-binary @video.mp4
Recommendation

Use the default local Whisper workflow for sensitive media, and use cloud engines only when the provider, cost, and data-handling terms are acceptable.