YM-MediaToolkit(媒体处理工具集)

流式视频处理工具集 - 压缩、封面提取、音频转换，无需下载完整视频

This skill appears to implement the advertised streaming media processing and includes URL and path checks, but there are multiple inconsistencies you should resolve before installing: (1) Ensure ffmpeg and ffprobe are installed on the host (they are required by the code but not declared in the top-level registry requirements). (2) The published version metadata (3.0.0) does not match the included skill.json/SKILL.md (2.1.0) — ask the author to explain/version-lock. (3) If you plan to run the HTTP server, install Flask (SKILL.md mentions it but requirements.txt omits it). (4) Run the skill in an isolated, non-root environment (container) with restricted outbound network access and a controlled working directory so sanitize_output_path cannot write to unintended locations (if the agent's working directory is '/', absolute writes may still be possible). (5) Test the URL validation behavior (DNS resolution fail-close, IPv6 mapping) in your environment to ensure legitimate sources you rely on are reachable. If the author can fix the manifest/version inconsistency and clearly document required binaries and Python deps, the skill is coherent; until then treat it as suspicious and run only in an isolated sandbox.

Type: OpenClaw Skill Name: ym-mediatoolkit Version: 3.0.0 The ym-mediatoolkit skill is a well-structured video processing utility that uses ffmpeg and OpenCV for streaming compression and extraction. It demonstrates strong security practices by implementing robust SSRF protection (including DNS resolution checks and private IP blocking) and path traversal defenses in utils.py. The code logic is transparent, follows security best practices for subprocess handling, and is strictly aligned with its stated purpose of media manipulation without evidence of malicious intent.