Video Dub Clawhub

Windows-first video localization pipeline for downloading, transcribing, translating, dubbing, and retiming YouTube or Bilibili videos.

This skill appears to be what it says (a local video localization pipeline) but there are a few things to check before installing or running it: - Metadata mismatch: the registry lists no required env vars/binaries, but SKILL.md and the scripts require ffmpeg, node, Python 3.10+, and at least DEEPSEEK_API_KEY. Don't trust registry metadata alone — follow SKILL.md and inspect files. - Inspect DeepSeek and TTS provider code: open video_pipeline/scripts/services/deepseek_translator.py and the TTS provider files to see exactly which remote endpoints are used and what data is sent (translation requests include transcript text and may include short context). If you must keep transcripts private, prefer a local translation/TTS or review provider privacy/retention policies. - Prefer ephemeral env vars: when testing, set DEEPSEEK_API_KEY and YTDLP_COOKIES_FILE only in the current shell/session rather than persisting at user-level. Persisting environment variables stores secrets on disk and increases risk. - Check for bugs / run in sandbox: some parts of bundled code show sloppy issues (the shipped scripts contain truncated lines and at least one reference to an undefined variable in a truncated file excerpt). Run the pipeline on non-sensitive sample videos in an isolated environment first (or in a VM/container) and inspect logs and network calls. - Package installs: pip install -r requirements.txt will pull heavy ML packages (torch, openai-whisper). Ensure you understand the runtime cost and network access required for package installation and model downloads. - Cookies file is sensitive: YTDLP_COOKIES_FILE points to a browser cookies.txt which can include authentication cookies. Only use a cookies file you control and avoid persisting paths/shared storage. If you want to proceed, first review deepseek_translator.py and any 'requests.post' or remote hostnames in the services folder, avoid persisting API keys, and test locally on non-sensitive content.

Type: OpenClaw Skill Name: video-dub Version: 1.0.4 The skill bundle provides a complex video localization pipeline that utilizes high-risk system capabilities. Key indicators include the extensive use of 'subprocess.run' to execute external utilities like ffmpeg and yt-dlp, and the dynamic generation and execution of PowerShell scripts for Windows SAPI TTS in 'windows_sapi_tts_provider.py'. Furthermore, 'download.py' supports extracting browser cookies via 'YTDLP_COOKIES_FROM_BROWSER', a sensitive capability. While these features are plausibly necessary for the stated purpose of downloading and processing videos, the lack of robust input sanitization in shell commands and the broad system access (network, file, and shell) present a significant security risk and potential for exploitation.