Wjs Localizing Video

ReviewAudited by ClawScan on May 13, 2026.

Overview

The skill is coherent for video localization, but review is advised because it delegates core work to other skills and may automatically download an unpinned ffmpeg binary while using external TTS/LLM services.

Before installing, review the four referenced sub-skills and avoid letting the workflow auto-download ffmpeg unless you trust the source or can verify the binary. Use local, least-privilege TTS credentials, and do not process private videos unless you are comfortable sending transcript/subtitle text to the selected LLM and TTS providers.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

During subtitle rendering, the workflow could run a downloaded ffmpeg binary on the user's machine.

Why it was flagged

The documentation describes automatically obtaining a third-party static ffmpeg executable for rendering, but the reviewed artifacts do not provide pinning, checksums, provenance verification, or explicit user approval for that runtime binary.

Skill content
Auto-fetches a libass-enabled static ffmpeg if the system one is stripped ... evermeet.cx ... static macOS ffmpeg builds
Recommendation

Require explicit user approval before downloading ffmpeg, pin the exact build, verify a checksum/signature, or instruct users to install a trusted local ffmpeg themselves.

What this means

Installing this orchestrator alone does not fully describe or review the behavior of the actual transcription, translation, dubbing, and rendering components.

Why it was flagged

The orchestrator transparently depends on separate sub-skills that are not part of the provided artifact set, so this review cannot assess their implementation details.

Skill content
Routes to the four focused sub-skills — /wjs-transcribing-audio, /wjs-translating-subtitles, /wjs-dubbing-video, /wjs-burning-subtitles
Recommendation

Review the four referenced sub-skills before using the full pipeline, especially any that run local commands, call providers, or handle credentials.

What this means

If the user enables Volcano TTS, the workflow can use their speech-service account and may incur provider usage or billing.

Why it was flagged

The skill documents optional Volcano TTS credentials for Chinese dubbing; this is purpose-aligned for a TTS integration, and the artifacts do not show hardcoding, logging, or unrelated use of those credentials.

Skill content
export VOLC_TTS_APPID=your_speech_app_id
export VOLC_TTS_ACCESS_TOKEN=your_speech_access_token
Recommendation

Use least-privilege provider credentials, set them only in the local environment, and avoid pasting tokens directly into prompts or shared logs.

What this means

Private video transcripts or subtitle text may be processed by external services during translation or dubbing.

Why it was flagged

The workflow sends subtitle text or dubbing text to external model/TTS providers as part of its stated purpose.

Skill content
Hand the SRT to Claude (or any LLM) ... Voice routing: zh_*_bigtts → Volcano TTS 2.0 ... Anything else → edge-tts
Recommendation

Use this only with content you are comfortable sending to the selected providers, and check provider privacy and retention settings for sensitive media.