Video Insight

Cross-platform video transcript extraction and optional AI summarization for YouTube and Bilibili. GPU auto-detect. Transcript-first with opt-in LLM summary.

What to consider before installing: - Privacy: transcripts are cached permanently under ~/.cache/video-insight. If transcripts may contain sensitive content, clear or relocate the cache and inspect Cache.put/get behavior. - External LLMs: the summarization feature is opt-in, but if you set LLM_API_URL + LLM_API_KEY (or OPENCLAW_GATEWAY_TOKEN), the tool will POST the entire transcript to that endpoint (no truncation). Only set those env vars for endpoints you trust and that have an appropriate privacy policy. - Browser cookies: on download failure the tool retries with yt-dlp --cookies-from-browser chrome. That causes yt-dlp to access your browser cookie store (potentially exposing authenticated content). If you don't want local browser cookies accessed, avoid allowing that fallback or run in an isolated environment. - Installation: setup.sh installs Python packages from PyPI and may modify your Python environment or create a venv. Review the script before running; consider installing in an isolated virtual environment or container. - If you need higher assurance: request the publisher/source, verify package signatures or hashes, or run the tool in an isolated VM/container. If you want the skill but not remote summaries, do not set LLM_API_* or OPENCLAW_GATEWAY_TOKEN and avoid --summarize; manually review cached files and remove them if undesired. Additional info that would change this assessment: an authoritative source/homepage or explicit metadata declaring the env vars the skill expects (and the privacy implications), or removal/documentation of the yt-dlp cookie fallback. With those clarifications this would likely be classified as benign (coherent) rather than suspicious.

Type: OpenClaw Skill Name: video-insight Version: 1.0.0 The skill is classified as suspicious due to high-risk capabilities and potential vulnerabilities. Specifically, 'scripts/bilibili.py' attempts to access Chrome browser cookies via 'yt-dlp' to bypass anti-bot measures; while this is a standard feature for video extraction, it is not disclosed in the documentation. Additionally, 'scripts/utils.py' contains a potential Server-Side Request Forgery (SSRF) vulnerability in 'extract_bilibili_id' by following redirects on user-provided URLs without sanitization. These behaviors, while plausibly intended for the stated purpose, represent a significant attack surface and lack of transparency regarding sensitive data access.