VideoToText — subtitles & summary

This skill appears to implement exactly what it says (pull Bilibili subtitles and call an LLM to summarize) but before installing or supplying secrets consider the following: - Transparency: the registry metadata did not declare the environment variables the code actually expects. Confirm with the publisher which env vars are required (SESSDATA, BILI_JCT, DEDEUSERID, SUMMARY_LLM_API_KEY / OPENAI_API_KEY, SUMMARY_LLM_BASE_URL/CHAT_COMpletions_URL, etc.). - Secrets: do not provide your main account SESSDATA/Cookie to an untrusted or unknown source. Prefer using a throwaway/test Bilibili account if you need to run the skill. Likewise, use an ephemeral or scoped LLM API key or a self-hosted LLM endpoint rather than your primary, high-value key. - Data exfiltration surface: the skill will send subtitle text (which may be private) and the video title to the configured LLM endpoint. Ensure SUMMARY_LLM_BASE_URL / SUMMARY_LLM_CHAT_COMPLETIONS_URL points to a trustworthy service and that you understand the privacy policy of that endpoint. - .env location and path resolution: settings.py contains heuristics to locate a .env file; verify that the skill reads the .env you intend (place the .env next to SKILL.md as instructed) so it doesn't accidentally read a different .env in the runtime environment. - Audit and run offline: because the package includes the relevant source files, consider running the code locally in an isolated environment first (inspect it, run with dummy values, or with no credentials) to confirm behavior. The requirements are straightforward (httpx, pydantic, yt-dlp) — install in a virtualenv. - Publisher provenance: there is no homepage and the registry metadata lists an opaque owner ID. If you cannot verify the author or repository origin, exercise extra caution with credentials and prefer manual/local execution instead of granting agent-level access. If you need, I can: (a) list exactly which env variables the code reads and where, (b) point out the lines that assemble and send Cookie/LLM requests, or (c) produce a minimal safe-run checklist to test the skill without exposing real secrets.