music-manager

通用音乐下载管理器。支持从YouTube/Bilibili搜索下载音乐，自动转MP3，按分类存入本地音乐库

This skill appears to do what it claims: it runs a local Python script that calls yt-dlp to download and ffmpeg to convert audio. Before installing or running it, consider: (1) Browser cookies: enabling cookie extraction (BROWSER set to e.g. 'chrome') gives yt-dlp access to your browser session cookies — only enable this if you understand the privacy risk and trust yt-dlp on your machine. (2) Installation source: follow official install instructions for yt-dlp and ffmpeg (official releases or package manager) rather than untrusted downloads. (3) MUSIC_DIR: set the MUSIC_DIR to a directory you control to avoid overwriting important files. (4) Platform: SKILL.md uses brew (macOS); adapt install commands for Linux/Windows as appropriate. (5) Legality: downloading copyrighted content may violate terms or law in your jurisdiction — ensure you have rights to the media you fetch. If you want extra caution, run the script in an isolated environment (VM/container) and avoid enabling cookie extraction unless necessary.

Type: OpenClaw Skill Name: music-manager Version: 1.0.0 The skill facilitates music downloading via `yt-dlp` but defaults to extracting sensitive browser cookies (`--cookies-from-browser chrome`) and lacks input sanitization on the `category` parameter in `scripts/download_music.py`. This creates a path traversal vulnerability where a crafted category name (e.g., using `../`) could allow the script to write files to unauthorized locations on the filesystem. While these features are documented, the combination of sensitive data access and weak input validation poses a risk in an automated agent environment.