← 返回 Skills 市场
easonc13

M3U8 Downloader

作者 Eason Chen · GitHub ↗ · v1.0.0
cross-platform ⚠ suspicious
769
总下载
0
收藏
2
当前安装
1
版本数
在 OpenClaw 中安装
/install m3u8-downloader
功能描述
Download encrypted m3u8/HLS videos using parallel downloads. Use when given an m3u8 URL to download a video, especially encrypted HLS streams with AES-128.
使用说明 (SKILL.md)

M3U8 Video Downloader

Download HLS/m3u8 videos with parallel segment downloads and automatic decryption.

Prerequisites

  • aria2c (install: brew install aria2)
  • ffmpeg (install: brew install ffmpeg)

Full Workflow (From Webpage to MP4)

Step 1: Extract m3u8 URL from webpage

If given a webpage URL (not a direct m3u8), use browser automation to find the stream URL:

// In browser console or via browser tool evaluate
(() => {
  // Check HLS.js player instance
  if (window.hls && window.hls.url) return window.hls.url;
  if (window.player && window.player.hls && window.player.hls.url) return window.player.hls.url;
  
  // Search window objects for m3u8 URLs
  const allVars = Object.keys(window).filter(k => {
    try {
      return window[k] && typeof window[k] === 'object' && 
             window[k].url && window[k].url.includes('m3u8');
    } catch(e) { return false; }
  });
  return allVars.length > 0 ? allVars.map(k => window[k].url) : 'not found';
})()

Use profile=openclaw (isolated browser) to avoid browser history.

Step 2: Handle Master Playlist (Multi-Quality)

Master playlists list quality variants, not segments:

curl -s "https://example.com/playlist.m3u8"
# Output example:
# #EXT-X-STREAM-INF:BANDWIDTH=8247061,RESOLUTION=1920x1080
# 1080p/video.m3u8
# #EXT-X-STREAM-INF:BANDWIDTH=4738061,RESOLUTION=1280x720
# 720p/video.m3u8

Pick the highest quality (e.g., 1080p) and fetch that sub-playlist:

BASE_URL="https://example.com"
curl -s "${BASE_URL}/1080p/video.m3u8"

Step 3: Extract Segment URLs

Segments may have non-standard extensions (e.g., .jpeg instead of .ts):

mkdir -p /tmp/video_download && cd /tmp/video_download

BASE_URL="https://example.com/1080p"
curl -s "${BASE_URL}/video.m3u8" | grep -E "^[^#]" | while read seg; do
  echo "${BASE_URL}/${seg}"
done > urls.txt

# Count segments
wc -l urls.txt

Step 4: Parallel Download with aria2c

aria2c -i urls.txt -j 16 -x 16 -s 16 --file-allocation=none -c true \
  --console-log-level=warn --summary-interval=30
  • -j 16: 16 concurrent downloads
  • -x 16: 16 connections per file
  • -c true: continue partial downloads

Step 5: Merge with ffmpeg

# Get segment count
NUM_SEGMENTS=$(wc -l \x3C urls.txt)

# Generate file list (adjust filename pattern as needed)
for i in $(seq 0 $((NUM_SEGMENTS-1))); do
  echo "file 'video${i}.jpeg'"  # or video${i}.ts
done > filelist.txt

# Merge (copy streams, no re-encoding)
ffmpeg -y -f concat -safe 0 -i filelist.txt -c copy ~/Downloads/output.mp4

Step 6: Cleanup

rm -rf /tmp/video_download

Quick Script Usage

~/clawd/skills/m3u8-downloader/scripts/download.sh "https://example.com/video.m3u8" "output_name"

Note: The script may not handle all edge cases (master playlists, non-standard extensions). Use manual process above for complex streams.

Handling Encrypted Streams (AES-128)

Look for #EXT-X-KEY:METHOD=AES-128,URI="enc.key" in the playlist:

curl -s "https://example.com/path/enc.key" -o enc.key
ffmpeg -allowed_extensions ALL -i local_playlist.m3u8 -c copy output.mp4

Output

Final video saved as ~/Downloads/\x3Coutput_name>.mp4

安全使用建议
This skill appears to do what it says: download HLS segments, handle AES-128 keys, and merge with ffmpeg. Before using it: (1) confirm you have the right to download the target content; (2) install aria2c and ffmpeg from trusted package managers; (3) be cautious running the provided browser-console snippet on pages containing sensitive data (it runs in page context and can read JavaScript objects); (4) note the bundled script focuses on .ts segments and may fail for unusual segment extensions—use the manual workflow in SKILL.md for complex streams; (5) review the script if you want output in a different location (it writes into $HOME/Downloads) or different cleanup behavior. If you need higher assurance, run the script in a sandboxed environment first.
功能分析
Type: OpenClaw Skill Name: m3u8-downloader Version: 1.0.0 The skill's stated purpose is benign, but the `scripts/download.sh` script contains a critical shell injection vulnerability. The `OUTPUT_NAME` variable, derived directly from user input, is used unsanitized in `ffmpeg` commands. This allows an attacker to inject arbitrary shell commands, leading to remote code execution. There is no evidence of intentional malicious behavior like data exfiltration or persistence, classifying it as a severe vulnerability rather than malware.
能力评估
Purpose & Capability
Name/description (m3u8/HLS downloader) aligns with required tools and actions: fetching playlists/keys, parallel downloads with aria2c, and merging with ffmpeg. No unrelated binaries, credentials, or config paths are requested.
Instruction Scope
SKILL.md and the script stay within downloader behavior but include a browser-console snippet to locate m3u8 URLs on a page (expected for discovery). The SKILL.md notes possible non-standard segment extensions, but the shipped script mainly handles .ts segments (may fail for exotic extensions or some master-playlist edge cases). The instructions ask the user/agent to run JS in page context — this can access page state (which is necessary to find embedded streams) and should only be run on pages you trust.
Install Mechanism
No install spec and no external downloads; this is an instruction-only skill with a small shell script. Dependencies are external packages (aria2c, ffmpeg) which the SKILL.md documents; no arbitrary archives or network installers are used by the skill itself.
Credentials
The skill requests no environment variables or credentials. Network access to the provided m3u8 URL/key URL is required and expected. No unrelated secrets or system config paths are requested.
Persistence & Privilege
always is false, the skill does not request permanent/always-on presence, and it does not modify other skills or system-wide settings. It writes temporary files under $HOME/Downloads and removes its working directory at the end.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install m3u8-downloader
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /m3u8-downloader 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.0
Initial publish
元数据
Slug m3u8-downloader
版本 1.0.0
许可证
累计安装 2
当前安装数 2
历史版本数 1
常见问题

M3U8 Downloader 是什么?

Download encrypted m3u8/HLS videos using parallel downloads. Use when given an m3u8 URL to download a video, especially encrypted HLS streams with AES-128. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 769 次。

如何安装 M3U8 Downloader?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install m3u8-downloader」即可一键安装,无需额外配置。

M3U8 Downloader 是免费的吗?

是的,M3U8 Downloader 完全免费(开源免费),可自由下载、安装和使用。

M3U8 Downloader 支持哪些平台?

M3U8 Downloader 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 M3U8 Downloader?

由 Eason Chen(@easonc13)开发并维护,当前版本 v1.0.0。

💬 留言讨论