Video Analyzer

Download videos, extract transcripts, capture frames. Analyze YouTube, tutorials, DD videos with yt-dlp + Whisper + ffmpeg.

This skill appears to do what it says — it downloads video/audio, extracts frames, and runs a local Whisper transcription. Before installing or running it, verify you trust the yt-dlp/ffmpeg/whisper binaries on your system (install from official sources), run the scripts in a directory where large downloads and model files are acceptable, and be cautious about transcripts that may contain sensitive information: the README/examples show piping transcripts to 'clawdbot ask' (or other AI services), which would send that text off your machine. Also confirm you have the right to download the target videos and consider running the tool in a sandbox if you handle confidential content. If you want higher assurance, check the referenced GitHub repository (package.json) or inspect the scripts yourself — they are short and readable.

Type: OpenClaw Skill Name: videoanalyzer Version: 1.0.0 The skill bundle is designed for legitimate video analysis tasks, utilizing tools like yt-dlp, ffmpeg, and Whisper. However, it presents a significant prompt injection vulnerability in `scripts/summarize.sh` and the examples provided in `SKILL.md` and `README.md`. The content of the `transcript.txt` file, which is derived from user-provided video input, is directly embedded into a prompt for the AI agent without sanitization. This allows an attacker to craft a video whose transcript contains malicious instructions, potentially leading the AI agent to execute unauthorized commands or actions.