Video Subtitles
v1.0.0Generate SRT subtitles from video/audio with translation support. Transcribes Hebrew (ivrit.ai) and English (whisper), translates between languages, burns subtitles into video. Use for creating captions, transcripts, or hardcoded subtitles for WhatsApp/social media.
⭐ 15· 7.6k·68 current·74 all-time
byNimrod Gutman@ngutman
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to use an external Hebrew service (ivrit.ai) and OpenAI Whisper. Neither the SKILL.md nor the registry metadata declare any required API keys or credentials for external services. The README also asks the user to install 'ffmpeg-full' via brew (macOS) while the skill has no OS restriction — this is inconsistent. The 'uv' package manager is nonstandard and not justified.
Instruction Scope
Runtime instructions are limited to running scripts/generate_srt.py with flags (transcribe/translate/burn). That's appropriate for the stated purpose. However SKILL.md mentions automatic model downloads and external models (ivrit.ai, Whisper) without describing where data is sent, whether audio/video is uploaded to remote APIs, or what credentials/tokens are required. That gap could lead to unintended network access or data exfiltration by the script.
Install Mechanism
There is no install spec in the registry (instruction-only), but a Python script is included that will run and reportedly auto-download ~3GB models at runtime. Auto-downloading large model files at runtime from unspecified sources is a risk. The use of 'uv' as the package manager and a brew-only ffmpeg instruction are both unusual and not cross-platform; there is no guidance for Linux/Windows or verified trusted download hosts for models.
Credentials
The skill declares no required environment variables or primary credential, yet it references third-party services (ivrit.ai, OpenAI Whisper) which commonly require API keys. The absence of declared credentials is a mismatch: either the script uses unauthenticated remote services (privacy concern) or it expects keys but fails to document them (operational/permissions concern).
Persistence & Privilege
The skill does not set always:true and does not disable model invocation, so it behaves like a normal user-invoked skill. That is reasonable, but because it will read user-supplied video/audio files and can auto-download large models, you should be aware it may store sizable files on disk and perform network transfers when invoked. There's no explicit higher privilege requested.
What to consider before installing
This skill could be legitimate, but the manifest and README leave important questions unanswered. Before installing or running it: 1) Inspect scripts/generate_srt.py to confirm whether it uploads audio/video to remote APIs (ivrit.ai or OpenAI) and where it downloads model weights from. 2) Ask the author which environment variables or API keys are required and whether keys are ever transmitted or logged. 3) Verify the source URLs for model downloads and ffmpeg instructions; prefer well-known release hosts (GitHub releases, official project domains). 4) Clarify what 'uv' is and get cross-platform install instructions (Linux/Windows). 5) Run the tool in a sandbox/VM/container first to limit disk usage and network access. 6) If you cannot verify these points, do not provide sensitive credentials and consider this skill suspicious.Like a lobster shell, security has layers — review code before you run it.
latestvk9738tmfkxa36y4eqszg0y1rsd7zpgy7
License
MIT-0
Free to use, modify, and redistribute. No attribution required.