Reel to Skill
PassAudited by ClawScan on May 16, 2026.
Overview
The skill is coherent and purpose-aligned, but users should know it runs local video tools, may send extracted audio to OpenAI if an API key is present, and creates a persistent generated skill that should be reviewed.
Install only if you are comfortable running yt-dlp and ffmpeg on user-selected video URLs. If OPENAI_API_KEY is set, the extracted audio will be sent to OpenAI for transcription; unset the key to avoid that. Always review the generated skill before using it because it is derived from untrusted video content.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill will invoke local multimedia tools and download/process the URL the user supplies.
The script runs local yt-dlp and ffmpeg commands against the user-provided URL and downloaded file. This is central to the skill's video-download/transcription purpose and uses argument lists rather than shell interpolation.
subprocess.run(['yt-dlp', '-f', 'bv*+ba/best', '--merge-output-format', 'mp4', '-o', video_tpl, args.url], check=True) subprocess.run(['ffmpeg', '-y', '-i', str(mp4), '-vn', '-ac', '1', '-ar', '16000', str(audio)], check=True)
Use it only with links you intend to download, and keep yt-dlp and ffmpeg installed from trusted sources.
If OPENAI_API_KEY is set, transcription requests may consume OpenAI quota under that account.
The script uses an OpenAI API key from the environment if present. This credential use is expected for OpenAI transcription and the artifacts do not show hardcoding, logging, or unrelated use of the key.
key = os.environ.get('OPENAI_API_KEY') ... headers={'Authorization': f'Bearer {key}', 'Content-Type': f'multipart/form-data; boundary={boundary}'}Keep the API key in your environment rather than in generated files, and unset it if you do not want this skill to call OpenAI.
Audio from the provided video may be sent to OpenAI for transcription.
When an OpenAI key is available, the extracted audio file is uploaded to OpenAI's transcription endpoint. This provider call is disclosed in SKILL.md and directly supports the stated transcription purpose.
part('file', audio.read_bytes(), audio.name, 'audio/wav') ... urllib.request.Request('https://api.openai.com/v1/audio/transcriptions', data=b''.join(body), headers=...)Avoid running it on private or sensitive videos unless you are comfortable sending the audio to OpenAI, or unset OPENAI_API_KEY to prevent that path.
A generated skill may affect future agent behavior if its instructions are inaccurate, unsafe, or influenced by the source video.
The workflow turns untrusted social-video content into a persistent OpenClaw skill. This is the stated purpose, but generated instructions could preserve misleading or unsafe content if not reviewed.
Extract the repeatable procedure, decision rules, examples, and caveats. Create a skill folder under `skills/<skill-name>/`.
Review the generated SKILL.md before enabling or reusing it, and remove any instructions that are not part of the legitimate workflow.
The skill may fail or behave differently depending on the local yt-dlp and ffmpeg versions installed.
The skill depends on external local binaries, while the registry requirements list no required binaries and there is no install spec. The dependencies are disclosed in the skill text, so this is mainly a setup and provenance note.
The script uses: - `yt-dlp` for downloading - `ffmpeg` for audio extraction
Install and update these tools from trusted sources before using the skill.