Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

video-knowledge-ingest

v1.0.0

Ingest and summarize cross-platform videos into a local knowledge base. Use when working with YouTube, Bilibili, Xiaohongshu, or local media/subtitle files a...

0· 197·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for exsusiai/video-knowledge-ingest.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "video-knowledge-ingest" (exsusiai/video-knowledge-ingest) from ClawHub.
Skill page: https://clawhub.ai/exsusiai/video-knowledge-ingest
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install video-knowledge-ingest

ClawHub CLI

Package manager switcher

npx clawhub@latest install video-knowledge-ingest
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md and code clearly require external tools (yt-dlp, ffmpeg/ffprobe, summarize/codex, a Whisper venv) and write to a local knowledge root, but the registry metadata lists no required binaries or env vars. The script also embeds user-specific defaults (/home/jason/.openclaw/workspace and /home/jason/.local/bin) which may not be appropriate for other installations. The requested/used capabilities are coherent with the stated purpose, but the metadata omission and hard-coded paths are unexpected and may cause incorrect behavior.
Instruction Scope
SKILL.md stays on task: normalize URL, attempt subtitles, fall back to media download + Whisper, summarize, and persist results. However, it expects the summarization step to run via `summarize --cli codex` (an external service) and instructs persisting transcripts and summaries to a local knowledge base. The instructions do not request secrets but implicitly require codex authentication (not declared) and will send transcript text to that backend when used.
Install Mechanism
There is no install spec (instruction-only), so nothing is downloaded or installed by the platform. All executable behavior is in bundled scripts and Python files included with the skill. No external download/install URLs are used by the skill itself.
!
Credentials
The skill declares no required env vars, but the code assumes specific local resources: a workspace venv at a hard-coded path (e.g. /home/jason/.openclaw/workspace/.venv-whisper-gpu), and resolves fallback binary paths like /home/jason/.local/bin/yt-dlp and /home/jason/.local/bin/summarize. The run() helper also prepends /home/jason/.local/bin and /home/jason/.npm-global/bin to PATH for subprocesses. These assumptions are disproportionate (user-specific paths and PATH tweaks) and may cause unexpected use of local binaries or failure on other systems. The summarize/codex step will transmit transcript data to an external summarization backend if used; that external dependency is not represented in metadata.
Persistence & Privilege
The skill writes persistent artifacts (transcripts, summaries, metadata, downloads, and an append-only index) to a local knowledge-root (default under /home/jason/.openclaw/workspace/knowledge/video-notes). It does not request elevated platform privileges and is not always-enabled. Persisting user content locally is expected for its purpose but the hard-coded default path and the instruction 'do not move them unless asked' are noteworthy for users who expect skill data elsewhere.
What to consider before installing
This skill appears to implement the described video→transcript→summary pipeline, but exercise caution before installing: 1) The package metadata claims no required binaries, yet the code needs yt-dlp, ffmpeg/ffprobe, a Whisper venv, and the `summarize --cli codex` tool — ensure you install and trust those tools first. 2) The code uses hard-coded, user-specific paths (e.g. /home/jason/.openclaw/..., /home/jason/.local/bin) and temporarily prepends them to PATH for subprocesses; update these defaults to match your environment to avoid accidentally using unexpected binaries. 3) Summarization uses an external backend (codex) and will send transcript text to that service if you run it — confirm privacy and authentication expectations. 4) The skill writes persistent transcripts/summaries/index entries to a local KB (default path above); if that data is sensitive, change the KB root before use. 5) Because the skill has executable scripts, review and (if needed) run it in a sandbox or test workspace first. If you want to proceed, update the default paths in the scripts, install the declared tools, and verify codex/summarize authentication separately.

Like a lobster shell, security has layers — review code before you run it.

latestvk97frdngk7r6sv55v77b0th9w98337fh
197downloads
0stars
1versions
Updated 22h ago
v1.0.0
MIT-0

Video Knowledge Ingest

Use this skill as the default cross-platform video → transcript → summary → local-knowledge workflow.

Quick start

  1. Run the bundled entrypoint:
    • skills/video-knowledge-ingest/scripts/video-ingest.sh "<url-or-local-file>"
  2. Read the JSON stdout for paths.
  3. Send the summary back to the user from summary.md.
  4. Keep the stored files in the local knowledge base; do not move them unless asked.

Default knowledge-base root:

  • /home/jason/.openclaw/workspace/knowledge/video-notes/

What this skill invokes

Core tools in the normal path:

  • yt-dlp — resolve metadata, fetch subtitles, or download media
  • ffmpeg / ffprobe — normalize audio before transcription
  • bundled scripts/whisper-gpu.sh — local Whisper transcription using the workspace GPU venv
  • summarize --cli codex — generate the final written summary
  • local filesystem — persist transcript, summary, metadata, and index entries

Platform-specific notes:

  • YouTube: prefer subtitles when available; fall back to media download + Whisper
  • Bilibili: often falls back to Whisper; the script auto-normalizes bilibili.com/... to www.bilibili.com/... and strips spm_ tracking params
  • Xiaohongshu: usually no subtitles; expect media download + Whisper
  • Local subtitle/text files: skip download and summarize directly
  • Local media files: skip yt-dlp; go straight to Whisper

Workflow

1. Normalize the source

  • If the input is a URL, use the bundled normalizer.
  • Keep YouTube timing parameters (t, start, list, index) but drop common tracking params.
  • For Bilibili, force www.bilibili.com and remove spm_* query params.

2. Try subtitles first

  • Run yt-dlp in subtitle-only mode.
  • Prefer zh.* and en.* subtitles.
  • Treat subtitle download as best effort.
  • If any usable .srt / .vtt file lands, continue with that file even if another subtitle variant returned a non-zero exit code.

3. Fall back to media + Whisper

If no usable subtitles land:

  • Download best audio/media with yt-dlp
  • Transcribe with bundled scripts/whisper-gpu.sh
  • If GPU transcription fails, the script falls back to CPU automatically

4. Summarize

  • Summarize the resulting transcript with summarize --cli codex --force-summary
  • Expect codex to be installed and logged in, or configure the summarize backend another way before use

5. Persist results

For each ingested item, keep these files:

  • source.url or source.path
  • source.info.json
  • downloads/ (when remote media/subtitles are fetched)
  • whisper/ (when Whisper was used)
  • transcript.txt
  • summary.md
  • record.json
  • global append-only index: knowledge/video-notes/index.jsonl

Common commands

Remote URL:

skills/video-knowledge-ingest/scripts/video-ingest.sh "https://www.youtube.com/watch?v=..."
skills/video-knowledge-ingest/scripts/video-ingest.sh "https://bilibili.com/video/BV..."
skills/video-knowledge-ingest/scripts/video-ingest.sh "https://www.xiaohongshu.com/explore/..."

Local files:

skills/video-knowledge-ingest/scripts/video-ingest.sh /path/to/file.srt
skills/video-knowledge-ingest/scripts/video-ingest.sh /path/to/file.mp4

Custom output root:

skills/video-knowledge-ingest/scripts/video-ingest.sh "<source>" --kb-root /some/other/root

When to read bundled references

Read references/toolchain.md when you need:

  • dependency details
  • exact file layout
  • how each tool is used in the pipeline

Read references/troubleshooting.md when you hit:

  • YouTube anti-bot / cookies issues
  • Bilibili 403 on shared links
  • subtitle 429 / partial subtitle failures
  • Xiaohongshu subtitle absence
  • summarize / codex auth failures
  • Whisper venv, CUDA, ffmpeg, or yt-dlp problems

Operating rules

  • Prefer the bundled scripts/video-ingest.sh entrypoint over re-implementing the workflow.
  • Do not skip the local knowledge-base write unless explicitly asked.
  • When a run fails, inspect the generated directory before declaring total failure; partial artifacts often explain the real issue.
  • If a platform provides subtitles, prefer them over Whisper.
  • If subtitles are absent or unusable, fall back to media + Whisper automatically.

Comments

Loading comments...