bilibili-subtitle-analysis

B站字幕下载分析工具，基于 biliSub 项目。 支持：下载字幕、批量下载、内容分析、内容分析报告。 触发条件：用户要求下载B站字幕、分析字幕内容、生成内容报告。

Security Scan

The skill mostly matches its stated purpose (downloading and analyzing Bilibili subtitles) but includes inconsistent and risky instructions—most notably asking users to extract and 'send to openclaw' their Bilibili cookie and scanning user filesystem locations—which is disproportionate and a potential privacy/exfiltration risk.

Purpose & Capability

The skill's claimed purpose (download + analyze Bilibili subtitles) is consistent with the shipped code (index.js runs a Python biliSub script and performs text analysis). However the README/SKILL.md ask users to extract their B站 cookie and '发给openclaw' (send to openclaw), which is not reflected in declared requirements (no required env vars) and is unnecessary to document as external exfiltration. The code expects a local biliSub clone and may use cookies implicitly via the underlying Python script, but the instruction to send cookie data externally is disproportionate to the stated purpose.

Instruction Scope

SKILL.md/README instructs cloning biliSub, installing Python deps, and obtaining a Bilibili cookie via browser devtools. README explicitly tells users to '复制发给openclaw' (copy and send the cookie to openclaw), which directs sensitive credentials outside the user's environment. The runtime code (index.js) also scans various filesystem locations for a local 'biliSub' (including HOME, Downloads, Documents and a '.openclaw' path), reads environment variables broadly (process.env), and executes a Python script via child_process.execSync—behavior that goes beyond just parsing a single input file and can access user filesystem/environment context.

Install Mechanism

There is no formal install spec in the skill manifest, but SKILL.md instructs manual steps: git clone of an external GitHub repo and pip installs (including optional whisper/openai-whisper). Those are common for this kind of tool but require running arbitrary Python code from a third-party repo. No downloads from unknown shorteners are used, but the user is expected to run third-party code (biliSub) locally.

Credentials

The manifest declares no required environment variables or credentials, yet index.js reads and uses multiple env vars if present (BILI_OUTPUT_DIR, BILISUB_PATH, BILI_PYTHON_LIB, BILI_PROXY, BILI_PYTHON). README asks for a Bilibili login cookie and instructs sending it to the platform. Asking for a full login cookie (which can grant account access) and telling users to transmit it externally is a disproportionate and risky requirement for a subtitle downloader/analyzer.

Persistence & Privilege

The skill does not request 'always: true' and does not modify other skills. However it probes user directories (including a '.openclaw' folder and multiple home/downloads paths) to locate biliSub, which reads system state beyond the immediate working directory. This is not shown as a declared permission and could reveal the presence of files/folders on the host.

What to consider before installing

This skill's core functionality (downloading/analyzing subtitles) appears plausible, but there are red flags you should consider before installing: - Do NOT share your Bilibili cookie or any login credentials with the skill author or any external service. The README explicitly says to '复制发给openclaw' (copy and send the cookie to openclaw) — that is unnecessary and dangerous. A cookie can allow account access and should remain local. - The package runs a third-party Python script (biliSub) and asks you to git clone and pip install dependencies. Only do this if you trust the biliSub repo and are comfortable running its code locally. - The shipped JS probes many filesystem locations (HOME, Downloads, Documents, .openclaw) to find a biliSub copy. If you are concerned about privacy, run the tool in a sandboxed environment or container where it cannot access your personal files. - Prefer configuring any required cookie or credentials locally (e.g., set them in a local file or environment variable on your machine) rather than sending them to the skill author or platform. Ask the maintainer to provide explicit, local-only configuration instructions (e.g., set BILISUB_COOKIE or place a cookie file in the skill directory) instead of asking you to transmit secrets. - If you need stronger assurance, review the referenced enhanced_bilisub.py (and any pip-installed packages) before running, or use a throwaway Bilibili account with no personal data. Given the explicit instruction to externally transmit a login cookie and the code's filesystem probing, treat this skill as suspicious until the author clarifies how credentials are handled and removes any instruction to send cookies off-platform.

Bilibili 字幕下载分析 Skill

基于 biliSub 项目实现。

功能

1. 字幕下载

• 单个视频字幕下载（官方字幕）
• 自动语音识别（ASR）生成字幕
• 支持多种格式：JSON, TXT, SRT, ASS, VTT

2. 内容分析

• 基础统计：行数、字符数、平均行长、时间戳数量、视频时长
• 词频分析：中文高频词 TOP 30、英文高频词 TOP 30
• 双词组分析：bigrams TOP 20
• 情感分析：正面/负面/中性判断，情感得分
• 关键词提取：中英文关键词 TOP 10
• 文本密度：有效文本行占比

3. 详细总结报告（默认行为）

下载字幕后自动整理成详细的中文总结报告，包含：

• 视频概览：标题、时长、主题分类
• 核心内容：分段总结，主要观点提炼
• 关键引用：重要或精彩的原句摘录
• 结构化分析：分类整理（技术点、案例、观点等）
• 一句话点评：总结性评价

报告格式示例：

## 📺 视频总结：[视频标题]

**视频来源**：[BV号]
**视频时长**：X分钟
**主要内容**：一句话描述

---

### 🎮 核心内容
[分段详细总结，每段包含要点和原句]

### 💡 关键引用
- "摘录的精彩原句"

### 📊 结构化分析
| 类别 | 内容 |
|------|------|
| 分类1 | 要点 |

### 🎯 一句话点评
[总结评价]

使用方式

下载字幕

node index.js download <视频URL> [--formats json,txt] [--use-asr] [--asr-model small]

分析字幕

node index.js analyze <字幕文件路径>

批量下载

node index.js batch <URL列表文件路径>

设置 biliSub 路径

node index.js setpath <本地路径>

Node.js API

const BilibiliSubtitleAnalyzer = require('./index.js');

const analyzer = new BilibiliSubtitleAnalyzer({
  outputDir: './output',
  biliSubPath: 'C:\\Users\\lml\\biliSub',
  proxy: 'http://127.0.0.1:7890'
});

// 下载字幕
const files = await analyzer.downloadSubtitle('BV1xx411c79H', {
  formats: ['json', 'txt'],
  useAsr: true,
  asrModel: 'small'
});

// 分析字幕
const result = analyzer.analyzeContent('./output/BV1xx411c79H.json');

// 生成报告
const report = analyzer.generateReport(result, 'BV1xx411c79H');
console.log(report);

报告示例

╔══════════════════════════════════════════════════════════════════════╗
║                    📺 B站字幕内容分析报告                              ║
╚══════════════════════════════════════════════════════════════════════╝

🎬 视频信息: BV1xx411c79H

📊 字幕基础统计
───────────────────────────────────────────────────────────────────────
  • 总行数: 1250
  • 字符数（去空格）: 45000
  • 平均行长: 36.0 字符/行
  • 时间戳数量: 1250
  • 视频时长: 00:45:30

🔤 高频词 TOP 15（中）
  1. 你好: 45
  2. 我们: 38
  ...

💭 情感分析
  • 情感倾向: 🟡 中性
  • 情感得分: +5

安装依赖

# 克隆 biliSub 项目（MIT 许可证）
git clone https://github.com/lvusyy/biliSub

# 安装 Python 依赖
pip install -r requirements.txt

# 安装 bilibili-api
pip install bilibili-api-python==17.1.2

# 可选：安装 whisper（用于 ASR）
pip install openai-whisper

许可证声明

本技能基于 MIT 许可证开源的 biliSub 项目构建。 详细许可证声明请查看 LICENSE 文件。

注意事项

1. 使用 ASR 功能需要安装 ffmpeg
2. 批量下载时注意控制并发（默认 3）
3. 长视频处理可能需要较长时间（尤其 ASR）