Movie Subtitle Viewer

Search, download, parse, and summarize movie subtitles from OpenSubtitles in .srt or .ass formats using movie name and year.

This skill appears to implement an OpenSubtitles client and subtitle parser, which is coherent with its description — but there are several mismatches and missing files you should watch for before installing: - Credentials: The code expects OPENSUBTITLES_API_KEY, OPENSUBTITLES_USERNAME, and OPENSUBTITLES_PASSWORD in the environment, but the registry metadata lists no required env vars. Do not supply credentials until you confirm where and how they will be stored. Prefer creating a dedicated API key/account with least privilege. - Workspace writes: Downloaded subtitle files are saved into the workspace. If that workspace is backed up or synced, sensitive data could be persisted. Consider the storage location and clean-up policy. - Missing/unused files: SKILL.md and README reference a movie_summary.py and scripts/movie_viewer.py that are not present; the summary-generation step is not included in the bundle. Ask the author for the missing files or updated documentation. - Dependency handling: The package lists python-dotenv but code doesn't load it; verify how you will provide env vars (system env vs .env file). Avoid committing .env files with real credentials. If you want to proceed: (1) ask the maintainer to fix the registry metadata to declare required env vars and to provide the missing summary code, (2) run the code in a sandbox or isolated environment, and (3) avoid reusing high-value credentials — create a separate OpenSubtitles account/API key for testing.

Type: OpenClaw Skill Name: movie-subtitle-viewer Version: 0.1.0 The skill is functional for its stated purpose but contains a path traversal vulnerability in `src/subtitle_client.py`. The `download` method uses the `file_name` attribute directly from the OpenSubtitles API response as a local file path without sanitization, which could allow a malicious or compromised API response to overwrite arbitrary files in the agent's environment. While the logic in `SKILL.md` and the rest of the source code appears benign and aligned with the intended subtitle-viewing functionality, the lack of input sanitization on file operations is a significant security flaw.