Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Video Content Analyzer (Fixed)
v1.0.1Analyze videos by extracting frames every 10s, searching web references, storing metadata in Supabase, and generating Feishu Wiki reports.
⭐ 0· 45·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
The code implements the described features (ffmpeg extraction, Google Custom Search, Supabase storage, Feishu publishing) so functionality matches the description. However the package/registry metadata claims 'Required env vars: none' while SKILL.md and the code require multiple secrets (SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY, GOOGLE_API_KEY, GOOGLE_SEARCH_ENGINE_ID, FEISHU_APP_ID, FEISHU_APP_SECRET). Requiring a Supabase SERVICE_ROLE key is especially high privilege and not clearly necessary for normal per-user inserts (it bypasses row-level security). This mismatch between declared requirements and actual needs is incoherent and risky.
Instruction Scope
SKILL.md's runtime instructions are focused on processing a local video and publishing results. That scope matches the code. But repository includes workspace guidance files (AGENTS.md / BOOTSTRAP.md / SOUL.md / TOOLS.md) that instruct an agent to read local memory files, auto-update MEMORY.md, and 'commit and push your own changes' without explicit consent. Those additional agent-oriented instructions broaden the operational scope of the bundle beyond the stated skill and could cause an agent to access or transmit unrelated local data if followed.
Install Mechanism
There is no remote install/download step and dependencies are standard Python packages listed in requirements.txt. No external ad-hoc downloads or archive extraction are present in the manifest. Having source files included (Python modules) means code will run locally, but install mechanism itself is low risk.
Credentials
The skill requests multiple secrets in SKILL.md and the code expects them: SUPABASE_URL + SUPABASE_SERVICE_ROLE_KEY (high privilege), GOOGLE_API_KEY + GOOGLE_SEARCH_ENGINE_ID, and FEISHU_APP_ID + FEISHU_APP_SECRET. The registry metadata, however, declares no required env vars — an inconsistency. The SUPABASE_SERVICE_ROLE_KEY is particularly concerning because it grants full DB privileges and can bypass RLS, which is more access than a video-processor ordinarily needs. The number and sensitivity of secrets is high relative to the simple video-analysis description.
Persistence & Privilege
The skill is not set as always:true and uses normal autonomous invocation defaults. That is expected. However, combining autonomous invocation with the requested high-privilege SUPABASE_SERVICE_ROLE_KEY increases the potential blast radius if the skill runs autonomously or is compromised. The skill does not modify other skills or system-wide configs.
What to consider before installing
This skill contains working code that requires several secrets (Supabase service role key, Google API key, Feishu app secret) but the registry metadata incorrectly lists no required env vars — treat that as a red flag. Most important: do NOT provide SUPABASE_SERVICE_ROLE_KEY unless you fully trust the source; that key bypasses row-level security and can read/modify your entire database. Prefer running the code in an isolated environment and: 1) review the source yourself (you have it) before providing secrets; 2) use a least-privilege Supabase key (a restricted service account or per-user token) instead of service_role where possible; 3) create and test with throwaway/test Supabase and Feishu projects to confirm behavior; 4) verify the Feishu app and Google CSE are yours and have appropriate scopes/quotas; 5) be cautious about the AGENTS.md/BOOTSTRAP.md guidance — those files instruct an agent to read and persist local memory files and to commit/push changes, which could expose local data if followed. If you can't audit the code or provide restricted credentials, avoid installing or run it only in an isolated container/VM.Like a lobster shell, security has layers — review code before you run it.
latestvk97fpqzp204zyfha49q3g1vtw184ey62
License
MIT-0
Free to use, modify, and redistribute. No attribution required.