Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

youtube-stable-downloader

v1.0.4

Save YouTube videos locally in multiple resolutions (360p to 1080p, best quality) or extract audio for offline viewing.

0· 188·0 current·0 all-time
byXiaosen Li@xjouska

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xjouska/youtube-stable-downloader.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "youtube-stable-downloader" (xjouska/youtube-stable-downloader) from ClawHub.
Skill page: https://clawhub.ai/xjouska/youtube-stable-downloader
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install youtube-stable-downloader

ClawHub CLI

Package manager switcher

npx clawhub@latest install youtube-stable-downloader
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The declared purpose (save YouTube videos locally / extract audio) is plausible, but the SKILL.md describes a remote API and returns download URLs hosted on an aliyun OSS bucket. The registry entry contains no source code, homepage, or install spec, yet the SKILL.md instructs installing via an external ClawHub URL — this inconsistency (documented external service vs. no declared install/source) does not align cleanly with the stated purpose.
!
Instruction Scope
The instructions indicate the agent will send video URLs (and implicitly video data) to a remote service and receive a download_url (example: https://oss-bucket.aliyuncs.com/...). That means user content would be transmitted to an external endpoint not declared in the registry metadata. The SKILL.md also tells the user to run an external install command via a ClawHub link. There is no explicit guidance about data handling, retention, or consent.
Install Mechanism
There is no install spec in the registry, but SKILL.md explicitly instructs installing from a ClawHub URL. That mismatch is noteworthy: an instruction-only skill that asks the user/agent to pull code from an external URL increases risk because the package/source are not visible in the registry and were not vetted.
Credentials
The skill declares no required credentials or env vars, which seems minimal. However, the examples reference an Aliyun OSS host for storing resulting files — users are not asked for credentials, but their content would be sent to an external cloud. Lack of declared endpoints/credentials reduces transparency and prevents users from assessing where their data goes.
Persistence & Privilege
always is false and the skill does not request elevated platform privileges. Autonomous invocation is enabled (the platform default), which combined with the external-service behavior increases risk, but the privilege flags themselves are not excessive.
Scan Findings in Context
[no_regex_findings] expected: No code files were present and the scanner found no patterns. This is expected for an instruction-only SKILL.md, but absence of matches is not evidence of safety given the SKILL.md's external-install and remote-API instructions.
What to consider before installing
This skill's documentation expects the agent to use an external service (examples show files hosted on aliyuncs.com) and even instructs installing via a ClawHub URL, but the registry entry provides no source or install spec. Before installing, ask the publisher for: (1) the exact install URL and the code repository or binary release so you can review it; (2) the remote service endpoints that will receive your URLs/video data, who controls the storage (oss-bucket owner), retention and access policies, and any costs; (3) whether the service violates content provider TOS (e.g., YouTube) and any legal/privacy implications. Prefer skills that include source code or come from a trusted homepage. If you handle sensitive or private videos, do not install or use this skill until you get clear, auditable details about where data is uploaded and who can access it.

Like a lobster shell, security has layers — review code before you run it.

latestvk97c3ehaa848fpcrhycknwymed833z59
188downloads
0stars
1versions
Updated 21h ago
v1.0.4
MIT-0

Video Offline Saver Skill

Save online videos locally for offline viewing. Supports multiple quality options: 360p, 480p, 720p, 1080p, best quality, and audio-only extraction.

Quick Install

Tell OpenClaw:

"Install this skill: https://clawhub.ai/XJouska/u2-downloader"

OpenClaw will guide you through the setup process automatically.

Usage

Once installed, just tell OpenClaw what you need in natural language:

"Save this video for me: https://youtube.com/watch?v=dQw4w9WgXcQ"

"Save this video in 1080p: https://youtube.com/watch?v=xxxxx"

"Extract audio from this video: https://youtube.com/watch?v=xxxxx"

Supported quality options: 360p, 480p, 720p (default), 1080p, best, audio-only.

API Reference

POST /api/v1/skill/download

Save an online video for offline access.

Request:

{
  "youtube_url": "https://www.youtube.com/watch?v=dQw4w9WgXcQ",
  "resolution": "720"
}

Parameters:

  • youtube_url (required): The video URL to process
  • resolution (optional): Target quality — "360", "480", "720", "1080", "best", "audio". Default: "720"

Response (success):

{
  "success": true,
  "download_url": "https://oss-bucket.aliyuncs.com/skill/abc123/video.mp4",
  "video_title": "Video Title",
  "video_duration": 212,
  "file_size": 52428800,
  "resolution": "720",
  "processing_time": 45.2
}

GET /api/v1/skill/balance

Check account status.

Response:

{
  "username": "user123"
}

GET /api/v1/skill/health

Health check endpoint.

Response:

{
  "status": "healthy",
  "service": "Video Offline Saver Skill",
  "version": "1.0.0"
}

Error Codes

CodeMeaning
200Success
401Unauthorized
400Invalid request (bad URL, etc.)
500Server error

在线视频离线保存工具

将在线视频保存到本地,方便离线观看。支持多种画质选择:360p、480p、720p、1080p、最佳画质,以及纯音频提取。

快速安装

告诉 OpenClaw:

"帮我安装这个 skill:https://clawhub.ai/XJouska/u2-downloader"

OpenClaw 会自动引导你完成配置流程。

使用方式

安装完成后,直接用自然语言告诉 OpenClaw 你的需求,例如:

"帮我保存这个视频:https://youtube.com/watch?v=dQw4w9WgXcQ"

"把这个视频转成 1080p 离线版本:https://youtube.com/watch?v=xxxxx"

"提取这个视频的音频:https://youtube.com/watch?v=xxxxx"

支持的画质选项:360p、480p、720p(默认)、1080p、最佳画质、纯音频。

接口说明

POST /api/v1/skill/download

将在线视频保存为离线文件。

请求体:

{
  "youtube_url": "https://www.youtube.com/watch?v=dQw4w9WgXcQ",
  "resolution": "720"
}

参数:

  • youtube_url(必填):视频链接
  • resolution(选填):目标画质 — "360"、"480"、"720"、"1080"、"best"、"audio",默认 "720"

成功响应:

{
  "success": true,
  "download_url": "https://oss-bucket.aliyuncs.com/skill/abc123/video.mp4",
  "video_title": "视频标题",
  "video_duration": 212,
  "file_size": 52428800,
  "resolution": "720",
  "processing_time": 45.2
}

GET /api/v1/skill/balance

查询账户状态。

响应:

{
  "username": "user123"
}

GET /api/v1/skill/health

健康检查接口。

响应:

{
  "status": "healthy",
  "service": "在线视频离线保存工具",
  "version": "1.0.0"
}

错误码

状态码含义
200成功
401未授权
400请求无效(链接格式错误等)
500服务器错误

Comments

Loading comments...