ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Download Tools

v1.0.0

CLI download tools for YouTube and WeChat

⭐ 0· 1.5k·8 current·10 all-time
by@jqlong17
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (YouTube and WeChat download tools) align with required binaries (curl, yt-dlp) and the brew install entries (yt-dlp, ffmpeg). The included scripts implement exactly those functions.
✓
Instruction Scope
SKILL.md and the scripts limit actions to fetching user-provided URLs and writing local files (/tmp and cwd). There are no instructions to read unrelated files, access other system secrets, or send data to external endpoints beyond the user-specified download URLs.
✓
Install Mechanism
Install uses Homebrew packages (yt-dlp, ffmpeg), a standard package manager on macOS/Linux setups. No arbitrary URL downloads or archive extraction are used.
✓
Credentials
The skill declares no required environment variables or credentials. Scripts may suggest optional features (using browser cookies or proxies) but do not require or automatically access any secrets or credentials.
✓
Persistence & Privilege
Skill is not marked always:true, does not modify other skills or global agent settings, and does not request persistent elevated privileges.
Assessment
This package is internally consistent, but consider these practical points before installing: - It runs yt-dlp and curl to fetch content from user-supplied URLs and writes files to your current directory and /tmp. Ensure you run it from a safe working directory. - yt-dlp can be used to download copyrighted content; verify you have the right to download the media you target. - Some videos or WeChat articles may require cookies or login; the scripts mention using browser cookies or proxies but do not automatically access them — if you follow those suggestions you may expose browser data or credentials, so be cautious and understand the commands you run (e.g., --cookies-from-browser). - The install uses Homebrew; confirm you trust Homebrew on your machine and that you want yt-dlp/ffmpeg installed system-wide. - As with any third-party script, review the script sources (provided) before running, and keep yt-dlp/ffmpeg updated from their official sources.

Like a lobster shell, security has layers — review code before you run it.

latestvk978dkk2a8yk8zx0gf8889hztn819xbn

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Binscurl, yt-dlp

Install

Homebrew
Homebrew

Comments