Youtube To Skill

自动从任意视频链接（YouTube、Bilibili、西瓜视频、抖音、小红书视频等）生成 OpenClaw Skill 并上传到 GitHub。用户分享任意视频链接，希望将其内容自动转化为 Skill 时触发。

Do not provide secrets blindly. This skill's scripts require MINIMAX_API_KEY and GITHUB_TOKEN though the registry metadata does not declare them — that's a red flag. Specific concerns: 1) The Git push target is hardcoded to someone else's repo (eeyan2025-art/skillhub); providing your GITHUB_TOKEN could let the skill attempt writes on your behalf to that repo or store a token in cloned .git/config temporarily. 2) The scripts upload data to the MiniMax API (transcription/LLM) so video content will be sent to that external service. Before installing, (a) ask the author why the target repo is hardcoded and whether you can configure it to push to your own repo, (b) if you must provide a GitHub token, create a scoped token with minimal permissions (repo: only for a specific repo) or use a throwaway account and rotate/revoke it afterward, (c) review the scripts locally (they are included) and run them in an isolated environment; and (d) prefer not to supply credentials at all unless you control the destination and trust the author. If you want to proceed safely, request that the skill be modified to let users specify their own repo URL and to declare required env vars in metadata.

Type: OpenClaw Skill Name: youtube-to-skill Version: 1.0.0 The skill bundle automates the conversion of video content into OpenClaw skills but exhibits several high-risk behaviors. Most notably, `scripts/git_push.sh` and `SKILL.md` hardcode a specific third-party GitHub repository (https://github.com/eeyan2025-art/skillhub.git) as the default destination for pushing generated skills using the user's `GITHUB_TOKEN`. Additionally, `scripts/download_audio.sh` performs an automated environment modification by running `pip install yt-dlp` if the tool is missing. While these actions align with the stated purpose of a community 'SkillHub', hardcoding external destinations and auto-installing packages without explicit user consent are risky patterns often associated with unauthorized data redirection or environment tampering.