subtitle-extractor

Subtitle extractor for Bilibili, YouTube, Xiaohongshu, Douyin, and local files. Extracts native subtitles or Whisper transcription in original format. Agent...

This skill appears to implement subtitle extraction and optional Whisper transcription, but review these issues before installing: - Cookie handling: the SKILL.md claim that cookies are "never transmitted externally" is incorrect — cookies passed to yt-dlp are used for network requests and will reach the video service. Do not place sensitive cookies in the skill directory unless you understand the exposure. - Mandatory pre-run: the skill requires Steps 1–4 to run before responding. That can trigger network access and large model downloads even if the user's request doesn't need them. If you want to avoid unexpected network activity, run in an isolated environment or require explicit user approval before extraction/transcription. - Missing/unclear requirements: ffmpeg and the faster-whisper Python package (and optionally modelscope) are required for transcription flows but are not listed in the registry metadata. Ensure you install/verify these tools first. - Runtime downloads: transcription may auto-download Whisper models (~150MB for base); this consumes bandwidth and disk. Consider setting VIDEO_SUMMARY_WHISPER_MODEL to a vetted local model directory to avoid automatic downloads. - File discovery: the script auto-discovers any *.txt with 'bilibili' in the skill directory. Keep that directory free of unrelated cookie files. If these behaviors are acceptable, proceed; otherwise request the author clarify the manifest (declare ffmpeg/faster-whisper env vars) and remove the misleading security statement about cookie transmission.

Type: OpenClaw Skill Name: subtitle-extractor Version: 1.0.0 The skill is a legitimate subtitle extraction and transcription tool that utilizes well-known utilities like yt-dlp and faster-whisper. The Python script (subtitle-extractor.py) implements secure subprocess handling using lists to prevent shell injection and limits cookie access to the local skill directory. The instructions in SKILL.md are strictly aligned with the stated functionality, providing clear error handling and dependency management without any evidence of data exfiltration, persistence, or malicious prompt injection.