Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Youtube Lecture Analyzer

v1.0.1

Extracts and structures key points, evidence, and actionable insights from YouTube lecture subtitles for review and teaching purposes.

0· 314·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The script implements transcript fetching and summarization consistent with the described purpose. However, the inclusion of a forced HTTP/HTTPS proxy (http://127.0.0.1:26739) is not justified by the stated functionality and is unexpected for a simple transcript analyzer.
!
Instruction Scope
SKILL.md directs running the included Python script and lists the youtube-transcript-api dependency (consistent). It also documents the same local HTTP proxy requirement. The runtime instructions and the code do not read unrelated files or credentials, but they force network traffic through a local proxy — this broadens the scope of what network endpoints will see the transcript data.
Install Mechanism
This is an instruction-only skill with one included script and no install spec; no archives or remote downloads are executed by the skill. The risk is limited to running the provided Python file and any Python dependencies the user installs.
!
Credentials
No credentials or environment variables are declared/required, which is good. But the script unconditionally sets HTTP_PROXY and HTTPS_PROXY to a local address (127.0.0.1:26739). Requiring a local proxy for fetching YouTube transcripts is disproportionate and unexplained — it could be used to capture or forward fetched transcripts if that proxy is configured to relay externally.
Persistence & Privilege
The skill does not request permanent presence, does not set always:true, and does not modify other skills or system-wide settings. It writes an output file to the current working directory, which is expected behavior.
What to consider before installing
Before installing or running this skill, consider the following: (1) The script forces all HTTP(S) requests it makes through a local proxy at 127.0.0.1:26739 — verify why a proxy is required and what that proxy does. A malicious or misconfigured local proxy could forward transcripts or other data off your machine. (2) Metadata inconsistencies exist (different slug/version/homepage and an unused 'requests' dependency); these suggest the package may have been modified or not properly maintained. (3) If you still want to use it, inspect the code yourself (it is short), remove or neutralize the PROXY lines (os.environ['HTTP_PROXY'] / HTTPS_PROXY) or change them to a proxy you control, and run it in an isolated environment where you can monitor outgoing connections (e.g., sandbox, VM, or with network monitoring enabled). (4) If you cannot verify the proxy's purpose or origin, avoid running the script with a proxy listener present. If you need help auditing the proxy behavior or removing the proxy lines, provide the proxy's configuration or allow an isolated test run for network capture — that would raise confidence.

Like a lobster shell, security has layers — review code before you run it.

latestvk97cbevnj4a80v0m3q696fxq7181z6yj

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

YouTube 讲座字幕分析器

提取讲座核心结构、关键观点、证据与可执行行动,用于复盘/写作/教学。

使用方式

# 基础用法
python scripts/analyze_lecture.py <YouTube视频ID或URL>

# 指定语言优先级
python scripts/analyze_lecture.py <YouTube视频ID或URL> "zh-cn,en"

# 仅获取摘要
python scripts/analyze_lecture.py <YouTube视频ID或URL> --summary-only

输出格式

强制规则

  1. 只基于字幕,不要补充;不确定要标注【不确定】
  2. 先去噪:合并重复观点、删除口头禅、修正口误
  3. 每个关键结论附【原文短引文】10–30字
  4. 区分:事实(Fact) / 观点(Claim) / 推断(Inference) / 建议(Recommendation)

输出结构

  • A) 一句话总论(≤25字)
  • B) 讲座结构地图(3–6段)
  • C) 5个关键问题及回答
  • D) 核心概念与关系
  • E) 可执行提炼(行动清单)
  • F) 亮点与反直觉
  • G) 盲区与待验证
  • 摘要(中文200字 + 英文200字)

依赖

  • youtube-transcript-api
  • HTTP 代理:127.0.0.1:26739

Files

3 total
Select a file
Select a file to preview.

Comments

Loading comments…