Video Analyzer

Download, transcribe, and analyze videos from YouTube, X/Twitter, and TikTok with local Whisper processing. Perfect for extracting TL;DRs, timestamps, and ac...

This skill appears to do exactly what it says: download videos, transcribe locally with whisper-cpp, and produce timestamped transcripts. Before installing, consider: 1) It will install Homebrew packages and download Whisper models (the 'max' model is ~3GB) to /opt/homebrew/share/whisper-cpp — ensure you have disk space. 2) The script writes to /tmp and your Desktop (downloaded media), so expect files on disk. 3) The code runs shell commands via subprocess with formatted strings; while it attempts basic quoting for URLs, avoid passing untrusted or crafted inputs (especially odd --lang values) — review the script if you plan to run it in a security-sensitive environment. 4) The skill does not ask for API keys or try to send transcripts to external endpoints (only model downloads from huggingface and media fetches from the video host), but if you need stronger guarantees, run it in a sandbox or inspect/modify the script to use subprocess calls without shell=True (list form) and stricter input validation. If those trade-offs are acceptable, the skill is coherent and implementationally reasonable.

Type: OpenClaw Skill Name: video-analyzer-skill Version: 1.0.1 The skill contains a shell injection vulnerability in `scripts/analyze_video.py` due to the use of `subprocess.run(shell=True)` combined with insufficient input sanitization in the `quote_url` function. A crafted URL containing single quotes and command separators (e.g., `'; touch /tmp/pwned; '`) could lead to arbitrary command execution. While the skill's behavior of downloading videos and fetching models from Hugging Face (`huggingface.co`) aligns with its stated purpose, these high-risk capabilities and the underlying implementation flaw warrant a suspicious classification.