Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
YouTube to Chinese
v1.0.0将提供的 YouTube 视频链接转录成完整中文稿，包含内容摘要和视频核心亮点，便于快速理解和复习。
⭐ 0· 262·1 current·1 all-time
by古 晖@webguhui
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (YouTube → Chinese transcript/summary) aligns with included files and runtime steps: a downloader script and instructions to pass the downloaded audio to the platform's audios_understand tool. No unrelated binaries, env vars, or hosts are requested.
Instruction Scope
SKILL.md stays within scope: download audio, transcribe via audios_understand, and format output. It does recommend optional use of browser cookies (browser:chrome) or a cookies.txt export to bypass YouTube bot/region checks — this increases the scope to reading browser cookies if the user explicitly chooses that option.
Install Mechanism
Instruction-only skill with a small shell script. No install spec. The only external download suggested (if needed) is yt-dlp from the official GitHub releases URL — a well-known release host. No obscure URLs or archive extraction are used.
Credentials
The skill itself requires no environment variables or credentials. The only potential sensitive access is optional: using browser:chrome or passing a cookies.txt file to allow yt-dlp to use logged-in cookies. That is user-controlled but can expose browser session cookies if used.
Persistence & Privilege
always is false and the skill does not request persistent system privileges or modify other skills. It runs a local script and relies on local binaries (yt-dlp, ffmpeg if user chooses to split).
Assessment
This skill appears coherent and implements a reasonable workflow for converting YouTube videos to Chinese transcripts. Before using it, consider: 1) Only supply cookies (browser:chrome or cookies.txt) if you understand that this gives yt-dlp access to your browser session cookies — avoid on sensitive accounts. 2) Verify any /tmp/yt-dlp binary before running (the script will prefer /tmp/yt-dlp if present). 3) If you run the suggested curl to update yt-dlp, ensure you trust the GitHub URL (the script points to the official yt-dlp release). 4) audios_understand is claimed to be an internal tool that processes local files; confirm your platform's privacy policy for how transcriptions are handled. If you avoid passing browser cookies and only run this on non-sensitive accounts/machines, the risk is low.Like a lobster shell, security has layers — review code before you run it.
chinesevk97dyczsnekwm9y4y6ea0f78h982pm79latestvk97dyczsnekwm9y4y6ea0f78h982pm79transcriptvk97dyczsnekwm9y4y6ea0f78h982pm79videovk97dyczsnekwm9y4y6ea0f78h982pm79youtubevk97dyczsnekwm9y4y6ea0f78h982pm79
License
MIT-0
Free to use, modify, and redistribute. No attribution required.