youtube-download-review

处理 YouTube 链接的视频下载与音乐向解读。只要用户提供 YouTube 链接，并提到下载视频、合并 MP4、下载封面、字幕处理（内嵌/忽略）、推荐理由、内容简介时，都应优先使用本技能。默认下载 1080p 视频 + 最高品质 m4a，自动合并为 mp4，并按视频标题创建目录输出全部产物。（此Skill 依...

This skill appears to do what it says (download YouTube videos, process subtitles, create a short music-focused review), but check the following before enabling: 1) The SKILL.md requires yt-dlp and ffmpeg, but the registry metadata does not declare them — ensure both are installed from trusted sources and that their versions are what you expect. 2) The skill writes files into the agent's current working directory using the video title for directory/filenames; run it in a dedicated/sandboxed folder to avoid accidental overwrites or confusing filenames. 3) Be aware of filename injection/path issues: validate or sandbox outputs (yt-dlp usually sanitizes filenames, but you should verify behavior in your environment). 4) Confirm you have the right to download the target content (copyright/legal risk). 5) If you do not want automatic downloads or disk writes, require explicit user confirmation for each link or disallow autonomous invocation. If you want to be more cautious, ask the skill author to: (a) add required-binaries to metadata, (b) provide an explicit install/verification step for yt-dlp/ffmpeg, and (c) document filename sanitization and overwrite behavior.

Type: OpenClaw Skill Name: youtube-download-review Version: 1.0.1 The skill provides YouTube downloading and processing functionality using yt-dlp and ffmpeg, but it is classified as suspicious due to a high risk of command injection. Specifically, SKILL.md instructs the agent to construct shell commands for ffmpeg and yt-dlp using unsanitized video titles and URLs as variables (e.g., in the ffmpeg -i and -vf arguments). While these capabilities are necessary for the stated task, the lack of input validation or escaping instructions could allow a maliciously titled video to execute arbitrary code on the host system.