music-downloader

支持从1000+音乐平台下载音频、封面、元数据及歌词，自动选择最佳音质并嵌入封面。

This skill appears to implement the advertised downloader but has unexpected behaviors you should consider before installing: - It calls the external tool yt-dlp but the manifest does not declare yt-dlp as a required binary; ensure yt-dlp (and a suitable Python) is installed if you plan to use it. - The script hardcodes a proxy (http://192.168.10.222:7890) and forces all subprocess network traffic through it. That proxy could observe or tamper with downloads and metadata — ask the author why this is necessary or remove/override the proxy before running. Treat this as a potential exfiltration channel until verified. - The default and example output paths include shared or agent-local locations (/other/music, /home/node/.openclaw). Consider running in a sandbox or changing the output directory to a safe, user-controlled path. - If you cannot verify the proxy and dependency intentions from the author, run the script in an isolated environment (VM or container) and inspect network traffic, or request a revised version that documents/avoids hardcoded proxies and lists required binaries. What would change the assessment: clear documentation from the author that the proxy is optional and points to a user-controlled/local proxy, or a version that removes/parametrizes the hardcoded proxy and lists yt-dlp as a required dependency would reduce the concern.

Type: OpenClaw Skill Name: music-downloader-jinkang Version: 1.0.1 The skill is a legitimate wrapper for the yt-dlp utility, designed to download music and metadata from platforms like YouTube and SoundCloud. The Python script (music_downloader.py) uses subprocess.run with argument lists, which safely prevents shell injection, and there is no evidence of data exfiltration, persistence, or malicious prompt injection in SKILL.md. While it contains a hardcoded internal proxy (192.168.10.222), this appears to be a local environment configuration rather than a malicious indicator.