← 返回 Skills 市场
385
总下载
0
收藏
2
当前安装
2
版本数
在 OpenClaw 中安装
/install video-clip-skill
功能描述
Clips a YouTube video locally using yt-dlp and ffmpeg. Supports auto-highlight detection, translation, and CapCut-style karaoke subtitle burning. Triggers wh...
安全使用建议
Before installing: (1) be aware the SKILL.md requires yt-dlp, ffmpeg and python3 even though the registry metadata omitted them — verify you have those trusted binaries installed. (2) The skill will run shell commands and execute the bundled Python script; it also asks the agent to generate a Python file containing translations and then run it — this means model-generated output will be executed as code, which is risky. Consider running in a sandbox or inspect the generated script before execution. (3) The optional GROQ_API_KEY will send audio to https://api.groq.com for transcription — only set this if you trust that service and are comfortable sending audio. (4) Avoid supplying sensitive cookies or credentials; if you must provide cookies.txt, make sure it only contains what you intend. (5) The included ass-karaoke.py appears to be a local subtitle generator with no network calls, but the overall workflow executes external tools and network requests; if you need this functionality, prefer running it manually or in a controlled environment and review any generated scripts before execution.
功能分析
Type: OpenClaw Skill
Name: video-clip-skill
Version: 1.0.1
The skill is classified as suspicious due to multiple critical vulnerabilities that could lead to Remote Code Execution (RCE) and arbitrary file system access, although there is no clear evidence of intentional malicious behavior by the skill author. Specifically, the `SKILL.md` instructions for the AI agent involve executing shell commands (`yt-dlp`, `ffmpeg`) with user-controlled arguments (`<URL>`, `<START>`, `<END>`, `<OUTPUT_FILE>`), which presents a high risk of shell injection if the agent does not properly sanitize or quote inputs. Furthermore, the agent is instructed to generate and execute a Python script with translated text embedded, creating a code injection vulnerability if the translated content (derived from user input) is not sanitized. The skill also performs broad file system operations (reading/writing VTT and output files) that, without robust sandboxing by the agent, could allow arbitrary file manipulation. The use of `GROQ_API_KEY` is for a stated legitimate purpose (transcription) but highlights a capability that could be abused.
能力评估
Purpose & Capability
The declared purpose (local YouTube clipping, subtitle translation, karaoke ASS generation) matches the SKILL.md and the included ass-karaoke.py. However the registry metadata lists no required binaries or env vars while SKILL.md explicitly requires yt-dlp, ffmpeg, and python3 (and optionally GROQ_API_KEY). The missing dependency declarations are an inconsistency that reduces transparency.
Instruction Scope
Instructions direct the agent to run arbitrary shell commands (yt-dlp, ffmpeg, cookies usage), locate files under ~/.claude/plugins, and — importantly — generate a Python script whose 'translations' list is filled by the model and then execute that script. Executing code that was produced at runtime by the model (even if nominally just a list of strings) is a vector for executing unexpected code if the generation is not strictly constrained. The find command could also match unexpected files under plugins if directory layout is different.
Install Mechanism
There is no install spec and the skill is instruction-only with one bundled Python script. Nothing is downloaded or extracted by the skill itself, which keeps install risk low.
Credentials
The skill has no required environment variables, but SKILL.md documents an optional GROQ_API_KEY for an external transcription service (api.groq.com). That optional credential is coherent with the claimed Whisper fallback, but the registry metadata did not advertise this optional env var. The skill may also encourage use of a cookies.txt file which could contain sensitive session cookies — the instructions reference using such a file for throttling workarounds.
Persistence & Privilege
The skill is not always-enabled and does not declare elevated persistence or attempts to modify other skills or system-wide settings. It runs on-demand and writes only its own ASS output file by design.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install video-clip-skill - 安装完成后，直接呼叫该 Skill 的名称或使用
/video-clip-skill触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.1
**No functional changes; documentation and description improvements.**
- Updated skill description for clarity: transcription fallback via GROQ_API_KEY now described as optional, not default.
- Instructions specify that finding the bundled `ass-karaoke.py` script only searches the plugin's own files.
- Clarified VTT filtering: extra metadata on timestamp lines should be stripped to ensure compatibility.
- Whisper fallback behavior now explicitly asks users how to proceed if no GROQ_API_KEY is set and no subs are available.
- Added minor clarifications and more robust language to the troubleshooting/common issues section.
v1.0.0
Initial release with local YouTube video clipping, highlight detection, and advanced subtitle features.
- Clips YouTube videos locally using yt-dlp and ffmpeg; no API key required.
- Supports auto-highlight mode that detects and suggests the most interesting segments.
- Downloads and trims original language subtitles; includes fallback to Whisper if subs are unavailable.
- Translates and burns karaoke-style bilingual subtitles (ASS) with bundled generator script.
- Provides detailed pipeline for fetching, processing, translating, and clipping video segments.
元数据
常见问题
video-clip-skill 是什么？
Clips a YouTube video locally using yt-dlp and ffmpeg. Supports auto-highlight detection, translation, and CapCut-style karaoke subtitle burning. Triggers wh... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 385 次。
如何安装 video-clip-skill？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install video-clip-skill」即可一键安装，无需额外配置。
video-clip-skill 是免费的吗？
是的，video-clip-skill 完全免费（开源免费），可自由下载、安装和使用。
video-clip-skill 支持哪些平台？
video-clip-skill 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 video-clip-skill？
由 chiny（@chyyynh）开发并维护，当前版本 v1.0.1。
推荐 Skills