Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Short Video Parser

v2.0.0

此技能用于解析短视频链接,支持解析抖音、快手、B站等多个主流平台的短视频和图文链接,并能自动提取语音内容转录为文字。适用于需要批量获取视频元数据或将视频内容转为文本的场景时使用此 skill。

1· 234·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for yangbuyiya/yby6-video-parser-skill.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Short Video Parser" (yangbuyiya/yby6-video-parser-skill) from ClawHub.
Skill page: https://clawhub.ai/yangbuyiya/yby6-video-parser-skill
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: SILICONFLOW_API_KEY (Optional, transcription is required and mandatory), parse_api_url (optional)
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install yby6-video-parser-skill

ClawHub CLI

Package manager switcher

npx clawhub@latest install yby6-video-parser-skill
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The name/description (video parsing + transcription) matches the included code: many platform parsers, video download, ffmpeg audio extraction, and a transcription flow that posts audio to SiliconFlow. However the registry metadata declares no required env vars or binaries, while SKILL.md and the code clearly expect ffmpeg and a SiliconFlow API key (.env / transcribe.py). That mismatch is unexpected and reduces confidence in the packaging.
Instruction Scope
SKILL.md and the scripts instruct the agent to: parse share URLs (many platforms), download video files, write temporary files under tmp/, call ffmpeg via subprocess to extract audio, and POST the audio to SiliconFlow's transcription API (default https://api.siliconflow.cn). These operations are coherent with the stated purpose. They do involve writing files to disk and transmitting audio to an external service; the README warns about network/API limits. The instructions do not request unrelated system secrets, but they do read a local .env file for configuration (api_key, parse_api_url, auto_cleanup).
Install Mechanism
There is no install spec (instruction-only in registry), yet the skill bundle contains many Python source files and a requirements.txt. This is not necessarily malicious but means the package supplies executable code that will run if the agent executes those scripts. No remote download/install URLs were used in the install spec (lowest installer risk), but the presence of executable code in the bundle increases the runtime surface that will execute HTTP requests and subprocess calls.
!
Credentials
The code and SKILL.md require or strongly expect a SiliconFlow API key and ffmpeg. Registry metadata lists no required env vars or binaries — an inconsistency. The only sensitive credential referenced is the SiliconFlow bearer token used to upload audio; that is directly related to transcription and is proportionate to the feature, but it is not declared in the registry. The optional parse_api_url can point to an external parser endpoint (which would cause parse requests to be sent there), so supplying that URL gives the skill ability to send share URLs to a third party.
Persistence & Privilege
The skill does not request permanent platform-wide presence (always:false) and does not attempt to modify other skills or system-wide settings. It writes temporary files and outputs reports to demos/ and tmp/ directories (expected for this functionality). The code will execute ffmpeg as a subprocess — normal for audio extraction but note subprocess invocation is present.
What to consider before installing
This package implements exactly the parsing and transcription behavior it advertises, but the registry metadata is incomplete and there are privacy implications you should consider before installing: - The transcribe flow uploads extracted audio to SiliconFlow (Bearer token from .env or --api_key). If you provide that API key the skill will send your audio to a third‑party service. If you don't want audio uploaded, do not provide the API key or avoid running the transcription step. - SKILL.md and scripts require ffmpeg on PATH (used via subprocess). The registry does not declare this requirement — install ffmpeg if you plan to transcribe. - The code downloads videos and stores them in tmp/ and writes Markdown reports to demos/. If you enable auto_cleanup=false or omit cleanup, media files are retained on disk. - The optional parse_api_url allows using an external parsing API; setting it causes your share URLs to be sent to that endpoint — only set it to a URL you trust. - Packaging mismatch: registry metadata not declaring required env vars/binaries is a red flag (sloppy or incomplete packaging). Prefer to inspect/run the code in a sandbox or VM first. Review .env and scripts/transcribe.py to confirm endpoints and remove or replace the external transcription endpoint if needed. Recommended actions before use: inspect the code locally, run in an isolated environment, avoid supplying API keys you don't trust, and consider building a local/no‑upload transcription path if you need to protect sensitive content.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Environment variables
SILICONFLOW_API_KEY (Optional, transcription is required and mandatory)required
parse_api_url (optional)required
latestvk97c9s2n7ef9cd9xw79xrvtceh83g3er
234downloads
1stars
2versions
Updated 21h ago
v2.0.0
MIT-0

视频解析与转录技能

此技能提供两个核心功能:视频元数据解析和视频语音转录。支持 20+ 个主流视频平台。

使用场景

当出现以下场景时,使用此 skill:

  • 当用户需要解析图集内容
  • 当用户提供视频分享链接,需要提取视频信息(无水印链接、封面、标题、作者等)时
  • 需要将视频中的语音内容转换为文字,用于字幕生成、内容笔记时
  • 解析图集内容时

核心功能

功能一:视频元数据解析

使用内置的解析器直接从视频分享链接中提取视频信息,无需依赖外部 API。

功能二:视频语音转录

通过自动化流程:解析视频 → 下载视频 → 提取音频 → 语音转录 → 生成 Markdown 报告。

如何使用

1. 安装依赖

pip install -r requirements.txt

2. 环境配置(仅语音转录功能需要)

复制一份项目根目录当中的.env.example.env 文件:

# SiliconFlow API Key (可选,需要转录必填)
# 获取地址: https://siliconflow.cn/
api_key=sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# 视频转录模型 (可选,默认: FunAudioLLM/SenseVoiceSmall)
# 支持的模型列表: https://docs.siliconflow.cn/api-reference/audio
model=FunAudioLLM/SenseVoiceSmall

# 视频解析 API 地址 (可选,用于转录功能)
# 如果留空或注释掉,则使用项目内置的本地解析器(推荐)
# 如果填写了外部 API 地址,则使用外部 API 进行视频解析
# 示例: parse_api_url=http://ip:8000/video/share/url/parse?url=
parse_api_url=

# SiliconFlow ASR API 地址 (可选,默认: https://api.siliconflow.cn/v1/audio/transcriptions)
siliconflow_api_url=https://api.siliconflow.cn/v1/audio/transcriptions

# 是否自动清理临时文件 (可选,默认: false)
# true: 自动删除临时文件(视频和音频)
# false: 保留临时文件在 tmp/目录中
auto_cleanup_temp_files=false

脚本使用说明

脚本一:scripts/skill.py - 视频元数据解析

作用: 解析视频分享链接,获取视频详细信息。

运行方式:

python scripts/skill.py [选项]

参数说明:

参数说明必需
--url要解析的视频分享链接
--list_platforms列出所有支持的平台

常用示例:

# 1) 列出支持的平台
python scripts/skill.py --list_platforms

# 2) 通过分享链接解析视频
python scripts/skill.py --url "https://v.douyin.com/xxxxxx"

输出格式:

{
  "video_url": "https://example.com/video.mp4",
  "cover_url": "https://example.com/cover.jpg",
  "title": "视频标题",
  "music_url": "https://example.com/music.mp3",
  "images": [
    {
      "url": "图片链接",
      "live_photo_url": "LivePhoto链接"
    }
  ],
  "author": {
    "uid": "作者ID",
    "name": "作者昵称",
    "avatar": "https://example.com/avatar.jpg"
  }
}

脚本二:scripts/transcribe.py - 视频语音转录

作用: 解析视频链接并自动转录语音内容为文字。

运行方式:

python scripts/transcribe.py --url <VIDEO_URL> [选项]

参数说明:

参数说明默认值
--url必需。要解析的视频分享链接
--api_keySiliconFlow API 密钥。未提供则从 .env 读取从 .env 读取
--model语音识别模型名称FunAudioLLM/SenseVoiceSmall
--parse_result已解析的结果 JSON 字符串(可选,跳过解析步骤)
--auto_cleanup是否自动清理临时文件(true/false)从 .env 读取
--use_local_parser是否使用本地解析器(true/false)从 .env 读取

常用示例:

# 1) 基础解析与转录
python scripts/transcribe.py --url "https://v.douyin.com/xxxxxx"

# 2) 指定 API Key 和模型
python scripts/transcribe.py --url "https://www.xiaohongshu.com/explore/xxxx" --api-key sk-your-key --model FunAudioLLM/SenseVoiceSmall

# 3) 保留临时文件
python scripts/transcribe.py --url "https://www.bilibili.com/video/xxxx" --auto_cleanup false

输出:

  • 命令行实时打印 JSON 格式结果
  • 自动在 demos/ 目录下生成结构化的 Markdown 报告

技能资源

核心脚本

  • scripts/skill.py - 视频元数据解析脚本
  • scripts/transcribe.py - 视频语音转录脚本

解析器目录

  • scripts/parser/ - 包含 20+ 个平台的解析器实现

输出目录

  • demos/ - Markdown 报告输出目录
  • tmp/ - 临时文件存储目录(视频、音频)

支持的平台

平台标识符平台标识符
抖音douyin快手kuaishou
小红书redbook哔哩哔哩bilibili
微博weibo皮皮虾pipixia
西瓜视频xigua微视weishi
绿洲lvzhou最右zuiyou
度小视quanmin梨视频lishipin
皮皮搞笑pipigaoxiao虎牙huya
A站acfun逗拍doupai
美拍meipai全民K歌quanminkge
六间房sixroom新片场xinpianchang
好看视频haokanTwittertwitter

注意事项

  1. 环境依赖: 语音转录功能需要预先安装 ffmpeg 并添加到环境变量
  2. 网络要求: 脚本需要访问网络进行视频解析和 API 调用
  3. API 限制: 语音转录受 SiliconFlow 额度限制
  4. 输出路径: 临时文件默认保存在 tmp/ 目录,Markdown 报告保存在 demos/ 目录
  5. 解析模式: 默认使用项目内置的本地解析器,无需配置外部 API

本 Skill 基于 parse-video-py 项目重构而来,感谢原作者的贡献。

Comments

Loading comments...