Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

YouTube/B站 视频搜索下载

v1.0.0

多站点视频搜索、下载、字幕提取工具。支持 YouTube、B站(Bilibili)等主流平台。 结合 YouTube Data API v3 进行高级搜索,yt-dlp 下载视频/音频/字幕。 核心能力:全站关键词搜索、频道浏览、按时间/播放量/相关度排序、下载视频、提取音频(MP3)、下载字幕(中英文)、查看视...

0· 143·4 current·4 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for joppyao-bit/yt-search-download.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "YouTube/B站 视频搜索下载" (joppyao-bit/yt-search-download) from ClawHub.
Skill page: https://clawhub.ai/joppyao-bit/yt-search-download
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install yt-search-download

ClawHub CLI

Package manager switcher

npx clawhub@latest install yt-search-download
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The description advertises multi-site support (YouTube and Bilibili) and advanced search, and the code and SKILL.md clearly implement YouTube Data API search + yt-dlp downloads. However: (1) the registry metadata lists no required environment variables even though the tool needs an API key (YT_BROWSE_API_KEY or YOUTUBE_API_KEY); (2) Bilibili search/browsing capability is claimed in README/SKILL.md but the provided script only calls YouTube APIs and formats YouTube URLs (no Bilibili API/search implementation). These are functional mismatches that could surprise users.
Instruction Scope
SKILL.md prescribes using the script at ~/.claude/skills/… and running yt-dlp commands (including --cookies-from-browser chrome) and auto-translating titles without asking the user. The download/subtitle instructions will cause the agent to: call Google APIs, run yt-dlp (which may access browser cookies), write .srt/.txt files to ~/Downloads, and post-process SRT into TXT via a small Python snippet. These actions are consistent with download tasks but the forced translation behavior (must replace '【译】___' without asking) is a policy/scope decision the user should be aware of.
Install Mechanism
No install spec is provided (instruction-only skill with included script file). No external archives or untrusted downloads are specified. The only runtime dependency (yt-dlp) is a common third‑party tool the SKILL.md asks the user to install via brew/pip — no hidden installer URLs or extract steps present.
!
Credentials
The code requires a YouTube API key (reads YT_BROWSE_API_KEY or YOUTUBE_API_KEY) but the registry metadata declared no required env vars — an inconsistency. Besides that, the skill does not request other credentials. Note: instructions encourage yt-dlp's --cookies-from-browser which can access browser cookies (sensitive), so users should understand that downloading certain videos may cause access to local browser profile data via yt-dlp.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system-wide settings. It will store its script under the skills directory (normal). It can be invoked autonomously (default), which is expected for skills, but that is not combined here with elevated privileges or hidden credentials.
What to consider before installing
Before installing: (1) realize the skill requires a YouTube API key (set YT_BROWSE_API_KEY or YOUTUBE_API_KEY) — the registry metadata omitted this, so it may fail if you don't provide it; (2) the README claims Bilibili support but the included script only implements YouTube search (you can still use yt-dlp to download Bilibili URLs, but channel/search features for Bilibili are not implemented); (3) the tool runs yt-dlp and recommends --cookies-from-browser, which can read browser cookies/profiles — only allow that if you trust the code and understand the privacy implications; (4) the skill will write downloads and generated .srt/.txt files to your Downloads directory; (5) if you care about safety, review scripts/yt_search.py locally (it uses subprocess.run without shell=True and uses the official Google Data API endpoints, which is good) and confirm you are comfortable with the forced auto-translation behavior specified in SKILL.md. If anything above is unexpected, don't install or run the skill until the author corrects the metadata and clarifies Bilibili support and cookie usage.

Like a lobster shell, security has layers — review code before you run it.

bilibilivk977b11663stfn6ed3gcdz1chn839ep4downloadvk977b11663stfn6ed3gcdz1chn839ep4latestvk977b11663stfn6ed3gcdz1chn839ep4subtitlevk977b11663stfn6ed3gcdz1chn839ep4videovk977b11663stfn6ed3gcdz1chn839ep4youtubevk977b11663stfn6ed3gcdz1chn839ep4
143downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

YouTube 搜索 & 下载

基于 YouTube Data API v3 进行高级搜索,配合 yt-dlp 下载。

前置条件

  1. YouTube API Key

    echo $YT_BROWSE_API_KEY
    

    如果为空:Google Cloud Console → 启用 YouTube Data API v3 → 创建 API Key → 写入 ~/.zshrc

    export YT_BROWSE_API_KEY=your_key
    
  2. yt-dlp(下载用):

    brew install yt-dlp   # macOS
    pip install yt-dlp     # 或 pip 安装
    

命令说明

脚本路径:~/.claude/skills/yt-search-download/scripts/yt_search.py

全站关键词搜索

python3 scripts/yt_search.py search "关键词" -n 20
参数说明
-n 20最多返回条数(默认 20)
-o date按时间排序(默认 relevance)
-o viewCount按播放量排序(API 级,准确)
--sort-by views本地二次排序(按播放量降序)
--sort-by duration-asc本地排序:时长从短到长
--sort-by duration-desc本地排序:时长从长到短
--min-duration 30m过滤:最短时长(支持 30m1h1h30m、纯数字=分钟)
--max-duration 1h过滤:最长时长
--after 2024-01-01发布时间起
--before 2024-12-31发布时间止
-c @handle限定频道
-d显示简介
--jsonJSON 格式输出

浏览频道视频

# 频道最新视频(按时间倒序)
python3 scripts/yt_search.py channel @channelHandle -n 10

# 频道内关键词搜索
python3 scripts/yt_search.py channel @channelHandle -q "关键词"

# 频道内按播放量排序
python3 scripts/yt_search.py channel @channelHandle -o viewCount

# 只看长视频(超过 1 小时)
python3 scripts/yt_search.py channel @channelHandle --min-duration 1h

# 只看短视频(30 分钟内),按时长升序
python3 scripts/yt_search.py channel @channelHandle --max-duration 30m --sort-by duration-asc

频道格式支持:@handlehttps://youtube.com/@handle、频道 ID(UCxxxx

下载视频

# 最佳画质下载到 ~/Downloads
python3 scripts/yt_search.py download "VIDEO_URL"

# 指定画质
python3 scripts/yt_search.py download "VIDEO_URL" -q 1080p

# 指定目录
python3 scripts/yt_search.py download "VIDEO_URL" --dir ~/Desktop

# 仅下载音频(MP3)
python3 scripts/yt_search.py download "VIDEO_URL" --audio-only

视频详情查询

python3 scripts/yt_search.py info "VIDEO_URL"

输出格式(Markdown 表格)

脚本已输出 Markdown 表格,AI 必须将每行的 【译】___ 替换为实际中文翻译后再呈现给用户。

最终呈现效果:

#标题(原文 → 中文译文)日期时长播放量
1Rick Beato: Greatest Guitarists...<br>里克·贝阿托:史上最伟大的吉他手2026-03-012h33m302.2K
2State of AI in 2026: LLMs, Coding...<br>2026年AI现状:大模型、编程、Scaling法则2026-01-314h25m741.7K

🔴 强制规范

  • ✅ 保留原英文标题(作为可点击链接)
  • 【译】___ 替换为简洁中文译文(放在链接后同一单元格)
  • ✅ 所有视频逐行翻译,不得跳过
  • ❌ 不询问用户是否需要翻译(直接翻译)
  • ❌ 不把 【译】___ 原样输出给用户

典型工作流

找某频道最新视频并下载:

  1. channel @handle -n 10 → 浏览结果
  2. 问用户要下载哪个
  3. download "URL" → 保存到 ~/Downloads

搜索 + 按播放量筛选:

  1. search "关键词" -o viewCount -n 20

提取播客音频:

  1. search "播客名" -o date -n 5
  2. download "URL" --audio-only

下载字幕(默认同时输出 SRT + TXT)

标准流程:下载字幕转为 SRT,同时生成保留时间戳的 TXT(供 AI 总结用,时间戳有助于定位内容)。

# Step 1:下载字幕并转为 SRT(英文优先,无则用自动字幕)
yt-dlp --cookies-from-browser chrome \
  --write-auto-sub --write-sub \
  --sub-lang en,zh-Hans \
  --convert-subs srt \
  --skip-download \
  -o "~/Downloads/%(title)s.%(ext)s" \
  "VIDEO_URL"
# 输出:~/Downloads/视频标题.en.srt 或 .zh-Hans.srt

# Step 2:从 SRT 生成 TXT(保留时间戳,仅去除序号和空行,供 AI 总结使用)
python3 -c "
import re, sys
srt = open(sys.argv[1]).read()
# 去除序号行(纯数字行),保留时间戳和字幕文本
txt = re.sub(r'^\d+\s*\n', '', srt, flags=re.MULTILINE)
txt = re.sub(r'\n{3,}', '\n\n', txt).strip()
txt_path = sys.argv[1].replace('.srt', '.txt')
open(txt_path, 'w').write(txt)
print(f'已保存:{txt_path}')
" ~/Downloads/视频标题.en.srt
# 输出:~/Downloads/视频标题.en.txt(格式:时间戳 + 字幕文本)

TXT 格式示例(保留时间戳,便于 AI 总结时引用具体时间点):

00:00:01,000 --> 00:00:04,000
Welcome to the Lex Fridman podcast.

00:00:05,000 --> 00:00:09,000
Today we're talking about the greatest guitarists of all time.

其他场景

# 仅中文字幕(SRT + TXT)
yt-dlp --cookies-from-browser chrome --write-auto-sub --write-sub \
  --sub-lang zh-Hans --convert-subs srt --skip-download \
  -o "~/Downloads/%(title)s.%(ext)s" "VIDEO_URL"

# 字幕 + 视频一起下载
yt-dlp --cookies-from-browser chrome --write-auto-sub --write-sub \
  --sub-lang en --convert-subs srt \
  -o "~/Downloads/%(title)s.%(ext)s" "VIDEO_URL"

规范:下载字幕时始终加 --convert-subs srt,下载完成后始终执行 Step 2 生成 TXT,让用户同时拿到 .srt(带时间轴)和 .txt(纯文本)两个文件。

高级用法(直接用 yt-dlp)

# 列出可用格式
yt-dlp --cookies-from-browser chrome -F "VIDEO_URL"

# 下载整个播放列表
yt-dlp --cookies-from-browser chrome -o "~/Downloads/%(playlist_title)s/%(title)s.%(ext)s" "PLAYLIST_URL"

Comments

Loading comments...