Video Content Analyzer (Fixed)

Analyze videos by extracting frames every 10s, searching web references, storing metadata in Supabase, and generating Feishu Wiki reports.

Security Scan

The skill mostly does what it claims (video frame extraction, Google search, Supabase storage, Feishu publishing) but contains mismatches and a high-privilege secret requirement (Supabase service role) that are disproportionate and not declared in registry metadata.

Purpose & Capability

The code implements the described features (ffmpeg extraction, Google Custom Search, Supabase storage, Feishu publishing) so functionality matches the description. However the package/registry metadata claims 'Required env vars: none' while SKILL.md and the code require multiple secrets (SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY, GOOGLE_API_KEY, GOOGLE_SEARCH_ENGINE_ID, FEISHU_APP_ID, FEISHU_APP_SECRET). Requiring a Supabase SERVICE_ROLE key is especially high privilege and not clearly necessary for normal per-user inserts (it bypasses row-level security). This mismatch between declared requirements and actual needs is incoherent and risky.

Instruction Scope

SKILL.md's runtime instructions are focused on processing a local video and publishing results. That scope matches the code. But repository includes workspace guidance files (AGENTS.md / BOOTSTRAP.md / SOUL.md / TOOLS.md) that instruct an agent to read local memory files, auto-update MEMORY.md, and 'commit and push your own changes' without explicit consent. Those additional agent-oriented instructions broaden the operational scope of the bundle beyond the stated skill and could cause an agent to access or transmit unrelated local data if followed.

Install Mechanism

There is no remote install/download step and dependencies are standard Python packages listed in requirements.txt. No external ad-hoc downloads or archive extraction are present in the manifest. Having source files included (Python modules) means code will run locally, but install mechanism itself is low risk.

Credentials

The skill requests multiple secrets in SKILL.md and the code expects them: SUPABASE_URL + SUPABASE_SERVICE_ROLE_KEY (high privilege), GOOGLE_API_KEY + GOOGLE_SEARCH_ENGINE_ID, and FEISHU_APP_ID + FEISHU_APP_SECRET. The registry metadata, however, declares no required env vars — an inconsistency. The SUPABASE_SERVICE_ROLE_KEY is particularly concerning because it grants full DB privileges and can bypass RLS, which is more access than a video-processor ordinarily needs. The number and sensitivity of secrets is high relative to the simple video-analysis description.

Persistence & Privilege

The skill is not set as always:true and uses normal autonomous invocation defaults. That is expected. However, combining autonomous invocation with the requested high-privilege SUPABASE_SERVICE_ROLE_KEY increases the potential blast radius if the skill runs autonomously or is compromised. The skill does not modify other skills or system-wide configs.

What to consider before installing

This skill contains working code that requires several secrets (Supabase service role key, Google API key, Feishu app secret) but the registry metadata incorrectly lists no required env vars — treat that as a red flag. Most important: do NOT provide SUPABASE_SERVICE_ROLE_KEY unless you fully trust the source; that key bypasses row-level security and can read/modify your entire database. Prefer running the code in an isolated environment and: 1) review the source yourself (you have it) before providing secrets; 2) use a least-privilege Supabase key (a restricted service account or per-user token) instead of service_role where possible; 3) create and test with throwaway/test Supabase and Feishu projects to confirm behavior; 4) verify the Feishu app and Google CSE are yours and have appropriate scopes/quotas; 5) be cautious about the AGENTS.md/BOOTSTRAP.md guidance — those files instruct an agent to read and persist local memory files and to commit/push changes, which could expose local data if followed. If you can't audit the code or provide restricted credentials, avoid installing or run it only in an isolated container/VM.

Video Content Analyzer - ClawHub Skill

Analyze video content, extract keyframes, search web for references, store metadata in Supabase, and generate Feishu Wiki reports.

Description

This skill provides a complete video content analysis workflow that automatically processes video files, extracts meaningful frames at configurable intervals, performs web searches for content references, stores all metadata and results in Supabase, and publishes professional analysis reports directly to Feishu Wiki.

Quick Start

# Install the skill
clawhub install video-content-analyzer

# Process a video file
CALL video-content-analyzer:process_video(
    video_path="/path/to/your/video.mp4",
    user_id="user-uuid-here",
    space_id="feishu-wiki-space-id"
)

Use Cases

• Content Creators: Automatically document and reference sources in video content
• Media Analysis: Process and catalog video libraries with searchable metadata
• Education: Generate indexed study materials from lecture recordings
• Compliance: Create audit trails for video content with source references

Features

Feature	Status
Video frame extraction at 10s intervals	✅
Google Custom Search API integration	✅
Supabase metadata storage	✅
Feishu Wiki report generation	✅
ffmpeg video probing	✅
Type coercion & error handling	✅ v1.0.1
Auto user profile creation	✅ v1.0.1
Feishu-compatible link rendering	✅ v1.0.1

Methods

process_video(video_path, user_id, space_id)

Main entry point for video analysis workflow.

Parameters:

• video_path (string, required): Local path to the input video file
• user_id (string, required): UUID of the user (for Supabase RLS)
• space_id (string, required): Feishu Wiki space ID for publishing

Workflow:

1. Probe video and extract metadata (duration, resolution, FPS)
2. Create video asset record in Supabase
3. Extract keyframes at 10-second intervals
4. Save frames to filesystem and database
5. Perform web search for frame content references
6. Store search results with relevance scoring
7. Generate structured analysis report
8. Publish to Feishu Wiki with proper link formatting
9. Update video status to "processed"

Environment Variables

Required in .env:

# Supabase
SUPABASE_URL=https://your-project.supabase.co
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key

# Google Custom Search
GOOGLE_API_KEY=your-google-api-key
GOOGLE_SEARCH_ENGINE_ID=your-search-engine-id

# Feishu/Lark
FEISHU_APP_ID=cli-your-app-id
FEISHU_APP_SECRET=your-app-secret

# Optional
FRAMES_OUTPUT_DIR=./extracted_frames

Database Schema

See supabase/migrations/ for complete schema.

• video_assets: Main video records with metadata
• video_frames: Extracted frames with timestamps and OCR content
• search_results: Google search references per frame
• wiki_pages: Generated wiki page records
• profiles: User profiles for RLS

Release Notes

v1.0.1

• FIX: Feishu Wiki search references now render correctly
• FIX: Supabase metadata storage issues resolved
• FIX: Video metadata fallback handling for edge cases
• IMPROVE: Added comprehensive logging

v1.0.0

• Initial release with core functionality