Universal Video to S3 Uploader

Download videos from YouTube, Twitter/X, TikTok, Douyin, Bilibili and upload to S3-compatible storage. Universal video downloader with smart quality selectio...

This package appears to implement a video downloader → S3 uploader, but it has several red flags you should consider before installing or running it: - Do not trust the README alone: the runtime scripts expect a config at /home/node/.openclaw/workspace/.r2-upload.yml, while docs tell you to use ~/.youtube-s3-uploader.yml. Verify which config file the code will actually read so you don't accidentally leak credentials or leave them in an unexpected location. - Inspect the code locally before running. The scripts use execSync/exec to run yt-dlp, ffmpeg and curl, and they read/write files under hardcoded workspace directories. Make sure those paths are acceptable and won't expose any sensitive data on your machine or agent workspace. - Be cautious about credentials: only provide S3 keys you control and consider using a scoped, low-privilege key or a dedicated test account. Do not reuse high-privilege AWS keys. - The package contains a script that edits other script files (scripts/add-import.js). Consider removing or reviewing that behavior if you plan to run the tool. - Ensure required binaries exist at the expected locations or modify the scripts to point to safe, known paths. Alternatively, run this in an isolated environment (container or VM) where accidental exposure is contained. If you want to proceed safely, run the code in a sandbox, correct the config path to the one you control, and test with temporary, limited-permission S3 credentials.

Type: OpenClaw Skill Name: youtube-s3-uploader Version: 3.0.5 The skill bundle contains multiple critical command injection vulnerabilities where user-provided URLs are directly interpolated into shell commands. Specifically, in 'scripts/video-to-s3-universal.js' and 'scripts/youtube-to-s3.js', the 'url' parameter is passed unsanitized to 'execSync' calls for 'yt-dlp'. Similarly, 'scripts/fixed-upload-video-to-s3.js' uses 'exec' to run 'curl' on a URL in the 'verifyUpload' function. While these flaws allow for arbitrary code execution if an attacker provides a crafted URL, they appear to be unintentional security oversights rather than intentional malware, as there is no evidence of data exfiltration or hidden backdoors.