Video Download Archive

Validate single video URLs, download highest-quality files with yt-dlp, and archive results into a Feishu Bitable using platform tools.

This skill appears to do what it claims (download with yt-dlp and record metadata), but there are several mismatches you should resolve before installing or running it: (1) The script requires external binaries (yt-dlp, ffprobe) and an external helper script at a hardcoded path (/home/jianhao/.../ytfetch.sh) that are not declared — verify that helper and binaries and inspect their contents before use. (2) A Feishu app token and table ID are hardcoded into the Python file: confirm whether that token is intended to be public, rotate it if it's yours, or remove it and supply credentials via platform-provided secure variables. (3) The script prints the token/table id in its JSON output — ensure the platform will not leak that output to third parties. (4) Test the skill in a sandboxed environment, request the author to document required runtime dependencies and the purpose/ownership of the embedded token, and ask for the ytfetch.sh source or a version included in the package. Resolving these items (especially verifying the ytfetch helper and the hardcoded token) would reduce risk and could change the assessment.

Type: OpenClaw Skill Name: video-download-archive Version: 1.0.0 The skill bundle contains a Python script (scripts/run_video_archive.py) that executes an external shell script using a hardcoded absolute path tied to a specific user's home directory (/home/jianhao/.openclaw/workspace/scripts/ytfetch.sh). This script is not included in the bundle, making its behavior opaque and creating a dependency on the local environment. Additionally, the script contains a hardcoded Feishu Bitable API token (BITABLE_APP_TOKEN), which is a poor security practice. While the logic appears aligned with the stated goal of video archiving, the execution of external, unverified shell scripts via absolute paths is a significant security risk.