Media Orchestrator

Unified skill for resolving, downloading, and delivering media (audio/video) to chat platforms. Integrates yt-dlp for resolution and handles Spotify metadata sync.

Key things to consider before installing: - The skill will execute yt-dlp (python -m yt_dlp) and optionally ffmpeg; these dependencies are not declared or installed by the skill. Ensure your environment has safe, vetted versions of yt-dlp and ffmpeg, and consider running in a sandbox. - The orchestrator hardcodes /home/ky11rie/.openclaw/workspace and calls another skill's script at workspace/skills/spotify-surface/scripts/spotify_surface.py. That means it expects and will execute code from other skills in the shared workspace — review spotify_surface.py (and any other referenced scripts) before enabling this skill. - The SKILL.md mentions 'Zero-Auth scraping' for Spotify metadata. Scraping can bypass APIs and may fetch data from third-party sites; check spotify_surface.py for network endpoints, credential usage, and compliance with service terms. - The script invokes the host CLI 'openclaw message send' to deliver files. Confirm that the message tool behaves as you expect and that the skill cannot send arbitrary filesystem files beyond its intended downloads. - Because the skill has exec + filesystem permissions and runs subprocesses, prefer installing only if you trust the source or after auditing the included scripts (spotify_surface and any invoked binaries). If you cannot review them, run the skill in an isolated environment with restricted filesystem/network access. - If you want to proceed but reduce risk: require the skill to declare/install yt-dlp/ffmpeg, remove hardcoded user paths (use workspace variable injection), and explicitly document the spotify_surface dependency and any credentials it needs.

Type: OpenClaw Skill Name: media-orchestrator Version: 0.1.1 The skill is designed to resolve, download, and deliver media using `yt-dlp` and a local `spotify-surface` script. The `orchestrator.py` script uses `subprocess.run` to execute necessary tools (`yt-dlp`, `openclaw message`, `python3 spotify_surface.py`) but passes user-controlled inputs as distinct arguments in lists, mitigating shell injection risks. File operations are confined to the OpenClaw workspace. The `SKILL.md` contains no prompt injection attempts. While the term 'Zero-Auth scraping' for Spotify metadata is noted, its stated purpose is local metadata resolution, not exfiltration, and the implementation delegates to a local script without showing malicious intent in the provided files.