Video Crawler

Extract videos from Douyin and Twitter by providing platform and URL, outputting the downloaded video file or an error message.

This skill appears to do what it says (download Douyin/X videos), but the embedded hard-coded API key in the source is a red flag. Before installing or running it: (1) ask the author why the DASHSCOPE_API_KEY exists and request its removal; (2) do not run it on machines or accounts that hold sensitive credentials; run it in an isolated sandbox/container if you must test; (3) if the key belongs to you or your org, assume it is compromised and rotate/revoke it immediately; (4) consider manually reviewing the code (or having a trusted reviewer do so) for any other hidden endpoints or secrets; and (5) prefer a version from a known, reputable source or one that does not contain embedded secrets.

Type: OpenClaw Skill Name: video-crawler Version: 1.0.0 The `video_crawler.py` script is vulnerable to arbitrary file write due to the `output_file` argument being directly used in `open()` and passed to `yt-dlp` without sanitization or path restrictions. An attacker or a compromised agent could specify a sensitive system path (e.g., `/etc/passwd`, `~/.bashrc`) as the output file, leading to file corruption, denial of service, or potential privilege escalation. Additionally, an unused API key (`DASHSCOPE_API_KEY`) is hardcoded in `video_crawler.py`, which is a bad security practice, though not directly exploitable in this version. There is no evidence of intentional malicious behavior like data exfiltration or backdoor installation, nor any prompt injection attempts in `SKILL.md`.