Wjs Localizing Video
PendingVirusTotal audit pending.
Overview
No VirusTotal analysis has been recorded yet. File reputation checks will appear here once the artifact hash has been scanned.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
During subtitle rendering, the workflow could run a downloaded ffmpeg binary on the user's machine.
The documentation describes automatically obtaining a third-party static ffmpeg executable for rendering, but the reviewed artifacts do not provide pinning, checksums, provenance verification, or explicit user approval for that runtime binary.
Auto-fetches a libass-enabled static ffmpeg if the system one is stripped ... evermeet.cx ... static macOS ffmpeg builds
Require explicit user approval before downloading ffmpeg, pin the exact build, verify a checksum/signature, or instruct users to install a trusted local ffmpeg themselves.
Installing this orchestrator alone does not fully describe or review the behavior of the actual transcription, translation, dubbing, and rendering components.
The orchestrator transparently depends on separate sub-skills that are not part of the provided artifact set, so this review cannot assess their implementation details.
Routes to the four focused sub-skills — /wjs-transcribing-audio, /wjs-translating-subtitles, /wjs-dubbing-video, /wjs-burning-subtitles
Review the four referenced sub-skills before using the full pipeline, especially any that run local commands, call providers, or handle credentials.
If the user enables Volcano TTS, the workflow can use their speech-service account and may incur provider usage or billing.
The skill documents optional Volcano TTS credentials for Chinese dubbing; this is purpose-aligned for a TTS integration, and the artifacts do not show hardcoding, logging, or unrelated use of those credentials.
export VOLC_TTS_APPID=your_speech_app_id export VOLC_TTS_ACCESS_TOKEN=your_speech_access_token
Use least-privilege provider credentials, set them only in the local environment, and avoid pasting tokens directly into prompts or shared logs.
Private video transcripts or subtitle text may be processed by external services during translation or dubbing.
The workflow sends subtitle text or dubbing text to external model/TTS providers as part of its stated purpose.
Hand the SRT to Claude (or any LLM) ... Voice routing: zh_*_bigtts → Volcano TTS 2.0 ... Anything else → edge-tts
Use this only with content you are comfortable sending to the selected providers, and check provider privacy and retention settings for sensitive media.