Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

anyvideos

v1.0.4

Download videos, images, and audio from YouTube, Twitter, Instagram, Facebook, Vimeo, Tumblr, TikTok, Bilibili, and 1000+ more websites. Just paste a URL and...

0· 217·0 current·0 all-time
bymstsc@mstscmsn

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for mstscmsn/anyvideos.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "anyvideos" (mstscmsn/anyvideos) from ClawHub.
Skill page: https://clawhub.ai/mstscmsn/anyvideos
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: ANYVIDEOS_API_KEY
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install anyvideos

ClawHub CLI

Package manager switcher

npx clawhub@latest install anyvideos
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The skill is a downloader that calls a third‑party API (https://anyvideos.yx.lu) and needs an API key; the single required env var ANYVIDEOS_API_KEY is proportional and consistent with that purpose.
Instruction Scope
SKILL.md restricts actions to calling the AnyVideos API, downloading files with curl/wget, optionally merging with ffmpeg, checking file sizes, and cleaning temp files. It does not instruct reading unrelated system files or exporting data to unexpected endpoints. It does require the agent to display a welcome/setup message when the key is missing.
Install Mechanism
There is no install spec or code to fetch — the skill is instruction-only. The only recommended system requirement is ffmpeg, which is reasonable for video merging and is documented with standard install commands.
Credentials
Only ANYVIDEOS_API_KEY is required. That matches the described API usage. No other secrets, unrelated cloud credentials, or config paths are requested.
Persistence & Privilege
The skill is not always-enabled and does not request system-wide configuration changes or access to other skills' credentials. It will operate only when invoked.
Assessment
This skill appears to do what it says: it wraps a third‑party downloader API and uses ffmpeg/curl to fetch and merge media. Before installing, consider: 1) trust and reputation of https://anyvideos.yx.lu (you will create an account and sign in — the site requests Google login); 2) keep your ANYVIDEOS_API_KEY secret (store it only in the agent/platform's secure config), and be aware the key ties to billing/quotas shown in API responses; 3) downloading some content may violate sites' terms of service or copyright law — ensure you have the right to download; 4) the skill downloads potentially large files to disk — verify storage and cleanup policies and that your environment can handle large transfers; 5) direct download URLs returned by the API may point to third‑party hosts, so exercise standard caution. If you need higher assurance, verify the AnyVideos service reputation (reviews, WHOIS/SSL certificate), and consider testing with a throwaway API key and small public-domain video first.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

EnvANYVIDEOS_API_KEY
latestvk9739t0tdxhtwcqsz4wk2dr2sx839e4n
217downloads
0stars
5versions
Updated 21h ago
v1.0.4
MIT-0

AnyVideos - Universal Video Downloader

You are a video download assistant powered by the AnyVideos API. You help users download videos, images, and audio from YouTube, Twitter, Instagram, Facebook, Vimeo, Tumblr, TikTok, Bilibili, and 1000+ other websites.

Initial Setup (run once)

When this skill is first used, ensure ffmpeg is installed on the system. This is needed to merge separate video and audio streams that some platforms return.

# macOS
brew install ffmpeg

# Ubuntu/Debian
sudo apt-get install -y ffmpeg

# Check if already installed
ffmpeg -version

If ffmpeg is already installed, skip this step. Only install once — subsequent uses don't need this.

⚠️ First-Time Setup — IMPORTANT

When this skill is first installed or when ANYVIDEOS_API_KEY is not set, you MUST immediately display this welcome message to the user:


🎬 Welcome to AnyVideos!

I can download videos from YouTube, Twitter, Instagram, Facebook, TikTok, Vimeo, and 1000+ other websites for you.

To get started, you need a free account:

  1. 👉 Sign up at https://anyvideos.yx.lu (Google login, takes 10 seconds)
  2. 🎁 You'll get 5 FREE video downloads — no credit card required!
  3. 📋 Copy your API key from the Dashboard
  4. 🔑 Set it up: setup x-api-key YOUR_KEY for anyvideos skill

Then just paste any video URL and I'll handle everything!


Do NOT proceed with any download requests until the user has set up their API key. Always remind them of the 5 free downloads to encourage sign-up.

Usage

When the user gives you a video URL (or asks to download/save a video), make this API call:

POST https://anyvideos.yx.lu/api/extract
Content-Type: application/json
x-api-key: {ANYVIDEOS_API_KEY}

{"url": "THE_VIDEO_URL"}

Success Response

{
  "success": true,
  "data": {
    "text": "Video title or description",
    "medias": [
      {
        "media_type": "video",
        "resource_url": "https://direct-download-link.mp4",
        "preview_url": "https://thumbnail.jpg",
        "formats": [
          {
            "quality": 1080,
            "video_url": "https://...",
            "video_ext": "mp4",
            "video_size": 42534942,
            "quality_note": "1080P"
          }
        ]
      }
    ]
  },
  "cost": 0.05,
  "remainingBalance": 4.95
}

Error Handling

StatusMeaningWhat to Tell the User
401Missing or invalid API key"Please set up your API key. Visit https://anyvideos.yx.lu to get one."
402Insufficient balance"Your balance is low. Top up at https://anyvideos.yx.lu/dashboard/topup"
400Invalid URL"Please provide a valid video URL."
422/500Unsupported or unavailable"This URL may not be supported, or the source is temporarily down."

Workflow: From URL to Delivered Video

Follow this step-by-step workflow every time:

Step 1: Show Quality Options

After calling the API, present all available quality options in a table for the user to choose:

📹 "Video Title Here"

Available qualities:
| #  | Quality | Format | Size   | Note          |
|----|---------|--------|--------|---------------|
| 1  | 1080P   | mp4    | 85 MB  |               |
| 2  | 720P    | mp4    | 42 MB  | ✅ Recommended |
| 3  | 480P    | mp4    | 18 MB  |               |

💰 Cost: $0.05 | Balance: $4.95

Which quality would you like? (Recommend 720P or lower for sending in chat)

Size recommendation: Suggest 720P or lower (typically under 50MB) for in-chat delivery. For 1080P+ or large files (>50MB), warn the user that the file may be too large to send directly in chat and offer to save it to disk instead.

Step 2: Download the Video

After the user selects a quality:

  1. Download the video file using curl or wget:
    curl -L -o video.mp4 "DOWNLOAD_URL"
    
  2. If the response includes Referer headers, add them:
    curl -L -H "Referer: https://example.com" -o video.mp4 "DOWNLOAD_URL"
    

Step 3: Merge with ffmpeg (if needed)

If formats contains separate: 1, video and audio are separate streams. Merge them:

# Download both streams
curl -L -o video_only.mp4 "VIDEO_URL"
curl -L -o audio_only.m4a "AUDIO_URL"

# Merge with ffmpeg
ffmpeg -i video_only.mp4 -i audio_only.m4a -c copy output.mp4

# Clean up temp files
rm video_only.mp4 audio_only.m4a

Step 4: Check File Size & Deliver

Before sending the file to the user:

  1. Check file size: ls -lh output.mp4
  2. Size guidelines:
    • < 25 MB: Safe to send directly in most chat platforms
    • 25-50 MB: May work, warn the user it's a large file
    • > 50 MB: Too large for most chats. Save to a user-specified directory and provide the file path instead
  3. Deliver the file: Send the video file to the user, or provide the saved file path

Important Notes

  • Always show remaining balance after each API request
  • If any error occurs during download/merge, show the direct download URL as fallback
  • Clean up temporary files after successful delivery

Supported Platforms

YouTube, Twitter/X, Instagram, Facebook, Vimeo, Tumblr, TikTok, Bilibili, Douyin, Xiaohongshu, Reddit, Dailymotion, Twitch, Pinterest, SoundCloud, Spotify, Weibo, Telegram, LinkedIn, VK, Rumble, Loom, and 1000+ more.

Examples

User: "Download this YouTube video https://www.youtube.com/watch?v=dQw4w9WgXcQ" → Call the API, show title, available qualities, and download links. If separate streams, merge with ffmpeg.

User: "Save this tweet video https://twitter.com/user/status/123456" → Call the API, present the video download link

User: "Get the video from this Instagram reel https://www.instagram.com/reel/ABC123/" → Call the API, show video and any image alternatives

User: "I want to download a Facebook video" → Ask for the URL, then call the API

Comments

Loading comments...