推特视频下载器

推特视频下载器 - 下载 Twitter/X 视频、GIF 和音频（MP4/MP3），支持 1080p、2K、4K、8K 高清下载。适用于需要保存推特视频、提取音频的用户。⚠️ 中国大陆用户需要使用代理。

This skill appears to be a straightforward wrapper around yt-dlp and ffmpeg and does not request credentials or contact unexpected remote endpoints. Before installing or running: 1) ensure yt-dlp, ffmpeg and python3 are installed from trusted sources (brew/apt/pip or official releases); info.sh uses python3 but the metadata doesn't list it. 2) Be aware the scripts create files under ~/Downloads/twitter-videos and ~/Downloads/twitter-audio and will perform network requests to Twitter/X (use the --proxy option if required). 3) The URL validation in download.sh may reject some link formats the README claims to support (mobile.twitter.com/t.co); if you rely on those, test first or remove/adjust the validation. 4) Review the shell scripts yourself (they are short and readable) before running, especially if you plan to run them with elevated privileges. Overall there is no indication of exfiltration or malicious behavior, only minor implementation bugs and an undeclared runtime dependency (python3).

Type: OpenClaw Skill Name: twitter-video-downloader Version: 1.0.1 The skill bundle provides a utility for downloading Twitter videos using yt-dlp, but it contains shell injection vulnerabilities in scripts/download.sh and scripts/info.sh. The $PROXY_ARGS variable is expanded without quotes in shell commands, which could allow for arbitrary command execution if a crafted proxy string (e.g., containing semicolons or backticks) is provided. While the tool's behavior aligns with its stated purpose of assisting users with video downloads, the lack of input sanitization on the proxy parameter poses a security risk.