local-media-cataloger

Index local photos, videos, and creative assets into a searchable manifest with tags, dates, shoot info, and reuse ideas.

Security Scan

The skill is internally consistent and uses a local, auditable Python script to index files; it does not request credentials or perform network operations, but the README/SKILL.md promise more extraction (dimensions/duration/tags) than the bundled script implements, and the script will record full file paths and timestamps which users should treat as sensitive.

Purpose & Capability

The skill's name, description, declared dependency (python3), included files, and runtime instructions align with a local media cataloging tool. However, the SKILL.md and README claim extraction of dimensions, duration, tags and generation of reuse ideas; the bundled script only collects basic filesystem metadata (path, filename, ext, size, create/modify times). Generating tags or 'reuse ideas' could be done by the agent (LLM) using the manifest, but the script itself does not extract image dimensions, durations, or embedded metadata (EXIF) as the docs imply.

Instruction Scope

SKILL.md instructs scanning a user-provided folder and using the local script/resource — that is expected. The concern: the script recurses the entire folder tree and will record absolute paths and timestamps for every file under the supplied folder with no file-type filtering by default, which can expose unrelated or sensitive files if the user provides a broad root path. Also there is a mismatch between the described metadata extraction (dimensions/duration/tags) and what the script actually collects.

Install Mechanism

No installation spec — instruction-only skill with a local Python script. This is low risk: nothing is downloaded or written to system locations by an installer. The only runtime dependency declared is python3, which is appropriate and proportional.

Credentials

The skill does not request environment variables, credentials, or external config paths. That is proportionate to a local-only media cataloger. Note that the output CSV contains absolute paths and timestamps which should be treated as sensitive data by the user.

Persistence & Privilege

The skill does not request persistent system presence (always:false) and does not modify other skills or system-wide settings. It writes a manifest file (default media_manifest.csv) to the current working directory when the script is run — expected behavior for this tool.

Assessment

This skill appears to do what it says: it runs a local Python script to produce a manifest. Before installing or running it, do the following: 1) Inspect scripts/media_manifest.py yourself (it's short and readable). 2) Run it on a small, non-sensitive sample folder first (e.g., a test directory) to confirm output format. 3) Be careful to pass the intended media folder path — do NOT point it at root (/) or your whole home directory unless you intend to catalog everything, because the CSV includes absolute paths and timestamps. 4) If you need image/video dimensions, durations, or embedded EXIF tags, note that the bundled script does not extract those; consider extending the script (or using exiftool/ffprobe) before relying on those fields. 5) Keep the generated CSV secure (it may contain sensitive filenames/paths). 6) If you expect the agent to autonomously run this skill, restrict its scope in conversation and avoid granting access to broad filesystem roots. If you want, I can suggest safe command-line changes to add file-type filtering or EXIF extraction.

Purpose

Index local photos, videos, and creative assets into a searchable manifest with tags, dates, shoot info, and reuse ideas.

Trigger phrases

• 整理素材库
• catalog my media folder
• 摄影素材归档
• 视频素材清单
• asset manifest

Ask for these inputs

• media folder path
• tagging rules
• project or shoot name
• deliverable types
• favorite selection criteria

Workflow

1. Scan files and extract basic metadata such as extension, size, timestamps, and dimensions when available.
2. Apply consistent tags and generate a manifest CSV/JSON.
3. Flag near-duplicates for manual review using filename/date heuristics.
4. Suggest folder structures for archive, selects, exports, and delivery.
5. Return a catalog summary and reuse opportunities.

Output contract

• media manifest
• folder plan
• duplicate candidates
• reuse ideas

Files in this skill

• Script: {baseDir}/scripts/media_manifest.py
• Resource: {baseDir}/resources/metadata_schema.json

Operating rules

• Be concrete and action-oriented.
• Prefer preview / draft / simulation mode before destructive changes.
• If information is missing, ask only for the minimum needed to proceed.
• Never fabricate metrics, legal certainty, receipts, credentials, or evidence.
• Keep assumptions explicit.

Suggested prompts

• 整理素材库
• catalog my media folder
• 摄影素材归档

Use of script and resources

Use the bundled script when it helps the user produce a structured file, manifest, CSV, or first-pass draft. Use the resource file as the default schema, checklist, or preset when the user does not provide one.

Boundaries

• This skill supports planning, structuring, and first-pass artifacts.
• It should not claim that files were modified, messages were sent, or legal/financial decisions were finalized unless the user actually performed those actions.

Compatibility notes

• Directory-based AgentSkills/OpenClaw skill.
• Runtime dependency declared through metadata.openclaw.requires.
• Helper script is local and auditable: scripts/media_manifest.py.
• Bundled resource is local and referenced by the instructions: resources/metadata_schema.json.