vsum

视频 summarizer，支持 YouTube 和 Bilibili 视频自动获取字幕并 AI 总结，输出为 md 格式。适用于：用户给出一个视频链接，希望总结内容。

This skill appears to do what it says (download subtitles with yt-dlp and summarize them with an AI), but there are privacy and transparency gaps you should consider before installing: - You must have yt-dlp installed separately; the skill metadata doesn't state that as a required binary. - For Bilibili it uses yt-dlp's --cookies-from-browser option, which reads your browser's cookies (session tokens). That can expose sensitive session data; only run this if you trust the environment and understand the cookie access. - The SKILL.md mentions using external AI providers but does not declare how API keys are provided. Expect to supply an API key/credential to the agent; ensure you use a trusted provider and understand that subtitle text will be transmitted to that provider. - The helper script writes subtitle files to ~/Downloads; check that location if you are concerned about local storage or accidental disclosure. - If you need stronger guarantees, ask the author to: (1) add yt-dlp and required API credentials to the skill metadata, (2) document exactly where summaries are sent and how credentials are stored/used, and (3) avoid or clearly warn about reading browser cookies (or provide alternate auth flows).

Type: OpenClaw Skill Name: vsum Version: 1.0.0 The skill is classified as suspicious due to its use of `yt-dlp` with the `--cookies-from-browser chrome` option in `scripts/vsum.sh` and described in `SKILL.md`. While this functionality is stated as necessary for accessing Bilibili content, it grants the script access to potentially sensitive browser cookies. This capability, even if justified by the skill's purpose, represents a significant security risk and a potential vector for sensitive data exposure if the agent or skill were compromised, elevating it beyond benign.