Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Video Summarizer

v2.0.0

Multi-platform video transcript extraction and AI-powered summarization (YouTube, Bilibili, extensible). Use when you need to summarize videos, extract trans...

0· 61·0 current·0 all-time
bymcdowelll@mcdowell8023

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for mcdowell8023/wansan-video-summarizer.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Video Summarizer" (mcdowell8023/wansan-video-summarizer) from ClawHub.
Skill page: https://clawhub.ai/mcdowell8023/wansan-video-summarizer
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install wansan-video-summarizer

ClawHub CLI

Package manager switcher

npx clawhub@latest install wansan-video-summarizer
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description align with included code and dependencies (yt-dlp, ffmpeg, faster-whisper, youtube-transcript-api, innertube). Using yt-dlp + faster-whisper for Bilibili transcription and ffmpeg for frames is coherent. One minor mismatch: the README/SKILL.md emphasize an 'innertube ANDROID client + Cloudflare proxy' technique to avoid YouTube limits but the code excerpt doesn't show any explicit proxy endpoints or configuration—this is ambiguous but could be an implementation detail of the innertube library.
!
Instruction Scope
Runtime instructions and scripts will: (a) invoke yt-dlp with --cookies-from-browser chrome (this allows access to local browser cookies), (b) run ffmpeg and external subprocesses, (c) create files under /tmp and a skill-local config/settings.json, and (d) (per README) may call external LLM/image endpoints (LLM_API_URL, OPENCLAW_GATEWAY_TOKEN, GITHUB_TOKEN, POLLINATIONS_API_KEY) if provided. Access to browser cookies and unspecified proxy behavior is the primary scope creep risk; these are not required env vars but are implied by the download approach.
Install Mechanism
There is no registry install spec, but a bundled setup.sh installs a Python venv and pip packages (youtube-transcript-api, requests, innertube, faster-whisper) and checks for yt-dlp/ffmpeg. This is a common pattern; it uses pip (PyPI) and Homebrew for yt-dlp if needed—moderate risk but expected. Nothing in setup.sh downloads arbitrary archives from untrusted servers.
Credentials
Requires no credentials to run, but documents many optional environment variables (LLM_API_URL/KEY, OPENCLAW_GATEWAY_TOKEN, GITHUB_TOKEN, POLLINATIONS_API_KEY). Those are plausible for optional LLM/image fallbacks, but supplying broad tokens like GITHUB_TOKEN or gateway tokens increases blast radius. The SKILL.md/README do not require these; they are optional and explained as fallbacks.
Persistence & Privilege
The skill does not request always:true and is user-invocable. setup.sh writes only to its own skill config directory. It does not appear to modify other skills or global agent settings.
What to consider before installing
This skill appears to implement what it claims, but review and decide before installing: 1) setup.sh will create a venv and pip-install packages—inspect and run it yourself rather than blindly piping to shell. 2) yt-dlp is invoked with --cookies-from-browser chrome: that can cause local browser cookies (sensitive) to be read by yt-dlp; only allow this if you understand and accept that access. 3) The SKILL.md mentions using an 'innertube + Cloudflare proxy' technique to avoid rate limits—ask the author which endpoints/proxies are used or inspect code paths that call innertube to ensure no unexpected network endpoints are contacted. 4) Only provide optional tokens (LLM_API_KEY, GITHUB_TOKEN, OPENCLAW_GATEWAY_TOKEN, POLLINATIONS_API_KEY) if you trust the skill and intend to use those backends. If you want higher assurance, request the full summarize.py logic that performs LLM and network calls (the included file was truncated) and check for any hard-coded remote endpoints or obfuscated network behavior.

Like a lobster shell, security has layers — review code before you run it.

latestvk9776c317nqyk7z2wm0ks72esx84wyzy
61downloads
0stars
1versions
Updated 1w ago
v2.0.0
MIT-0

Video Summarizer Skill

多平台视频摘要工具,支持 YouTube 和 B站(未来可扩展更多平台),支持单个视频、频道扫描、每日批量处理。

功能

  • ✅ 获取 YouTube 视频信息(yt-dlp)
  • ✅ 提取字幕/transcript(youtube-transcript-api)
  • B站视频下载 + 语音转录(yt-dlp + faster-whisper,本地,无需 API Key)
  • B站关键帧提取(ffmpeg,每 30 秒一帧,供 agent 视觉分析)
  • ✅ 生成深度摘要(LLM API)
  • ✅ 输出 JSON 格式(agent 自行处理发送)
  • ✅ 支持多频道配置
  • ✅ 过滤 Shorts(< 5 分钟)
  • 🔮 架构可扩展:新增平台只需添加 extractor 模块

安装

cd ~/.openclaw/skills/video-summarizer
./setup.sh

安装完成后会引导你选择默认图文模式(可随时重新配置):

📋 选择默认图文模式:
  1) text-only    - 纯文字,不抽帧(最快)
  2) auto-insert  - 自动选帧插入文档(推荐平衡)
  3) ai-review    - AI 智能选图(默认,最佳效果,多消耗 ~5-8k token)
请选择 [1/2/3] (默认 3):

配置写入 config/settings.json,可随时运行 video-summarizer --setup 重新配置。

跨平台依赖安装

Linux(当前已支持)

sudo apt install ffmpeg
pip install faster-whisper yt-dlp youtube-transcript-api innertube

macOS

brew install ffmpeg
pip install faster-whisper yt-dlp youtube-transcript-api innertube

Windows

# 安装 ffmpeg(推荐 chocolatey 或 scoop)
choco install ffmpeg
# 或 scoop install ffmpeg

pip install faster-whisper yt-dlp youtube-transcript-api innertube

注意事项

  • 路径分隔符:脚本已使用 path.join(),跨平台兼容
  • faster-whisper:Windows 下需要 CUDA 或 CPU 模式(无 CUDA 时自动 fallback CPU,速度较慢)
  • Chrome cookies:各平台路径不同,yt-dlp 会自动处理
  • Python 版本:需要 Python 3.9+

核心依赖说明

依赖用途
yt-dlp视频下载、信息获取(YouTube + B站)
youtube-transcript-apiYouTube 字幕提取
innertube绕过 YouTube API 限流
faster-whisperB站语音转文字(本地,无需 API)
ffmpeg音频提取 + 关键帧截取(系统级)

工作原理

Skill 使用多种方法获取字幕,避免 YouTube 限流:

  1. innertube ANDROID client + Cloudflare proxy - 主要方法,绕过限流
  2. youtube-transcript-api - 备用方法

B站视频使用 yt-dlp 下载音频 → faster-whisper 本地转录,全程无需外部 API。

使用

三种图文模式

模式说明额外 token适用场景
text-only纯文字,不抽帧0快速摘要、纯文字需求
auto-insert固定规则选帧,按时间戳插入(帧偏移+5s避转场)~0平衡速度与图文效果
ai-review默认基于文章结构反向选图,可补帧/删帧/替换~5-8k最佳图文效果

ai-review 流程(文章驱动选图):

  1. Skill 抽帧 → 固定规则多选(~15-20帧,比最终需要多50%)
  2. 先写纯文字版文档(分好章节)
  3. 逐章判断:需要配图?→ 从已选帧匹配 / 补帧 / 跳过
  4. 输出精选帧 + 画面描述 + 对应章节

auto-insert 流程:

  1. Skill 抽帧 → 固定规则选帧(多选留余量)
  2. 帧时间偏移 +5s(避开转场)
  3. 按时间戳匹配章节,全部插入

通过以下方式指定模式(优先级从高到低):

  1. CLI 参数 --mode
  2. 环境变量 SUMMARY_MODE
  3. config/settings.json 中的 default_mode

1. 单个视频摘要(YouTube)

video-summarizer --url "https://www.youtube.com/watch?v=VIDEO_ID"

2. B站视频摘要

video-summarizer --url "https://www.bilibili.com/video/BV1xxxxx"

# 短链接也支持(自动跟随跳转)
video-summarizer --url "https://b23.tv/xxxxx"

# 指定图文模式
video-summarizer --url "https://www.bilibili.com/video/BV1xxxxx" --mode text-only
video-summarizer --url "https://www.bilibili.com/video/BV1xxxxx" --mode auto-insert
video-summarizer --url "https://www.bilibili.com/video/BV1xxxxx" --mode ai-review

# 自定义 whisper 模型(精度更高,但更慢)
video-summarizer --url "https://www.bilibili.com/video/BV1xxxxx" --whisper-model large-v3

# 跳过关键帧提取(等效 --mode text-only)
video-summarizer --url "https://www.bilibili.com/video/BV1xxxxx" --no-frames

# 自定义关键帧间隔(默认30秒一帧)
video-summarizer --url "https://www.bilibili.com/video/BV1xxxxx" --frame-interval 60

3. 频道扫描(过去 24 小时)

video-summarizer --channel "UC_x5XG1OV2P6uZZ5FSM9Ttw" --hours 24

4. 每日批量处理(Cron 用)

video-summarizer --config /path/to/channels.json --daily --output /tmp/video_daily.json

配置文件格式

channels.json:

{
  "channels": [
    {
      "name": "Lex Fridman",
      "id": "UCSHZKyawb77ixDdsGog4iWA",
      "url": "https://www.youtube.com/@lexfridman"
    },
    {
      "name": "Y Combinator",
      "id": "UCcefcZRL2oaA_uBNeo5UOWg",
      "url": "https://www.youtube.com/@ycombinator"
    }
  ],
  "hours_lookback": 24,
  "min_duration_seconds": 300,
  "max_videos_per_channel": 5
}

输出格式

{
  "generated_at": "2026-02-14T11:17:00Z",
  "items": [
    {
      "title": "视频标题",
      "url": "https://youtube.com/watch?v=...",
      "video_id": "VIDEO_ID",
      "platform": "youtube",
      "channel": "频道名",
      "duration": "15:30",
      "published": "2026-02-14T08:00:00Z",
      "has_transcript": true,
      "summary": "# 摘要内容(markdown)\n\n### 🎯 核心问题..."
    },
    {
      "video_id": "BV1xxxxx",
      "title": "B站视频标题",
      "url": "https://www.bilibili.com/video/BV1xxxxx",
      "platform": "bilibili",
      "has_transcript": true,
      "transcript_path": "/tmp/bili_BV1xxxxx_transcript.txt",
      "frame_files": ["/tmp/bili_BV1xxxxx_frames/frame_001.jpg", "..."],
      "frame_count": 12,
      "summary": "# 摘要内容(markdown)..."
    }
  ],
  "stats": {
    "total_videos": 5,
    "with_transcript": 4,
    "without_transcript": 1
  }
}

环境变量

变量用途必须
LLM_API_URL自定义 LLM API 端点
LLM_API_KEY自定义 LLM API Key
LLM_MODEL自定义模型名
OPENCLAW_GATEWAY_TOKENOpenClaw Gateway token
GITHUB_TOKENGitHub token(有 Copilot 订阅时可用)
POLLINATIONS_API_KEYPollinations API Key
SUMMARY_MODE图文模式:text-only / auto-insert / ai-review
WHISPER_MODELB站 whisper 模型大小(默认 small)
FRAME_INTERVALB站关键帧间隔秒数(默认 30)
FRAME_TIME_OFFSET帧时间戳偏移秒数,避开转场(默认 5)

无需任何 Key 也可运行:转录功能不需要 API Key;摘要功能会尝试 Pollinations 免费匿名调用。

故障排查

字幕获取失败

  • 视频可能没有字幕
  • 输出 JSON 中 has_transcript: false
  • Agent 应生成简短摘要(基于标题/描述)

yt-dlp 限流

  • 设置 REQUEST_DELAY_SECONDS (默认 3 秒)
  • 减少 max_videos_per_channel

Comments

Loading comments...