DD Video Analyzer

• Verdict: Pass
• Analyzed: May 11, 2026, 4:38 AM
• Findings: 0
• Version: 1.0.0
• Hash: 78d165f9377e8c8db8e6e90ae588b1419d6f59c5f90bcd7a75e0ea0e597bd53b
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: dd-video-analyzer Version: 1.0.0 The skill bundle provides legitimate video transcription and analysis functionality but contains shell injection vulnerabilities in `scripts/analyze.sh`. The script passes the `$URL` and `$OUTPUT_DIR` arguments directly to shell commands (yt-dlp, ffmpeg, and mkdir) without sufficient sanitization, which could lead to arbitrary command execution if the AI agent is provided with a crafted input. While the behavior aligns with the stated purpose, the lack of input validation in a script intended for AI-automated execution poses a significant security risk.