Video To Text

Video to text converter. Downloads videos from Bilibili using bilibili-api, from other sites using yt-dlp, then transcribes audio using faster-whisper. Use w...

This skill appears to do what it says: download video/audio and transcribe it locally. Before using it: (1) review the script locally (it’s short and readable) and run in an isolated environment (virtualenv, container). (2) Be cautious when supplying Bilibili credentials: copy SESSDATA/bili_jct/buvid3 only from your browser and do not paste them into shared repos or logs; prefer passing them on the command line for ephemeral use. (3) Ensure yt-dlp and ffmpeg are installed from trusted sources because the script invokes yt-dlp as a subprocess. (4) Expect large model downloads and disk usage for medium/large faster-whisper models. If you want higher assurance, run the script on a machine/account where leaked cookies would have limited impact.

Type: OpenClaw Skill Name: video-to-text-2 Version: 0.1.0 The skill is classified as suspicious due to its use of `subprocess.run` to execute external commands (`yt-dlp`), which, while necessary for its stated purpose, introduces a potential for shell or argument injection if the OpenClaw agent does not properly sanitize user-provided URLs or file paths before execution. Additionally, the script handles sensitive Bilibili authentication credentials (SESSDATA, bili_jct, buvid3) by allowing them to be passed as command-line arguments or stored in a global variable within `scripts/video_to_text.py`, which is a vulnerability in credential management that could lead to exposure. The `SKILL.md` itself does not contain malicious prompt injection but outlines a `bash` command usage that could be exploited by an agent if user input is directly interpolated.