video-transcript
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This skill is purpose-aligned for extracting video subtitles, but users should notice it relies on an external yt-dlp install and saves transcript files locally.
This appears safe for its stated purpose, but install yt-dlp only from a trusted source, be aware that transcripts are stored locally, and do not expect built-in Chinese translation from the provided code.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The behavior depends on whichever yt-dlp version is installed from the package source at setup time.
The skill depends on an external, unpinned package, while the registry metadata declares no required binaries or install spec. This is purpose-aligned but should be visible to the user.
pip install yt-dlp
Install yt-dlp from a trusted source and consider pinning or reviewing the version used.
Using the skill will run yt-dlp locally and make network requests to the referenced video platform.
The script invokes an external CLI tool to fetch subtitles. This is central to the skill's stated purpose and uses a fixed argument list rather than shell execution.
cmd = ['yt-dlp', '--skip-download', '--write-sub', '--write-auto-sub', ...] result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
Use it only for links you intend to process, and keep yt-dlp updated from a trusted source.
Transcripts remain on disk after use until the user deletes them.
The script persists downloaded transcript text in a local OpenClaw workspace directory. This is expected for a transcript tool, but retained files may contain content from private or sensitive videos.
output_dir = Path.home() / '.openclaw' / 'workspace' / 'video-transcripts'
...
with open(txt_file, 'w', encoding='utf-8') as f:
f.write(text_content)Review or delete the video-transcripts folder if processed videos contain sensitive information.
Users may expect a translation capability that the provided code does not implement.
The documentation promises Chinese translation for non-Chinese videos, but the included script only converts subtitle files to plain text and outputs the original transcript.
3. **翻译** - 如原文非中文，翻译为中文
Treat this as a transcript extractor unless a separate, reviewed translation step is added.