Video Download Transcribe

多平台视频下载 + 本地转录 + 视频内容分析。 **触发词**：这个视频说了什么、视频内容是什么、帮我看这个视频、下载这个视频、视频转录、字幕提取、B站视频、抖音视频、bilibili、youtube视频、帮我转录 **支持平台**：B站/抖音/TikTok/YouTube/小红书/微博/快手

Key points to consider before installing: - Missing declared env vars: the manifest lists no required environment variables, but the code and SKILL.md expect DOUYIN_CHROMIUM_PATH and several API keys (SILICONFLOW_API_KEY, MINIMAX_API_KEY, TikHub token, etc.). Ask the author to declare every required secret in the skill metadata before installing. - Inspect setup.sh and server.py: setup.sh will install Playwright/Chromium and assumes specific venv and repo locations; server.py contains hard-coded absolute paths (/Users/kk/...). These paths cause the skill to try importing code outside the skill folder — review those imports and remove or fix hard-coded paths. - External services & credentials: the skill will call third-party endpoints (liuxingw.com, tikhub, api.minimax.chat, api.siliconflow.cn). Do not provide unrelated credentials (AWS, GitHub, global OpenAI key) to make it work. If you must use cloud STT, restrict keys to a dedicated minimal-scope account and prefer local models. - Run in a contained environment first: install and run the setup and server in a sandboxed VM, container, or isolated user account. Verify what files are written (transcripts dir), what network calls are made, and which processes are spawned. - Prefer local-only configuration: if you only need local downloads + local whisper, disable or remove cloud/STT branches in server.py and avoid running the parts that call remote APIs. - If you plan to trust it, ask the maintainer to: (1) remove hard-coded absolute paths, (2) list all required env vars and secrets in the manifest, (3) provide an installation spec that doesn't rely on guessing user venv locations, and (4) document what external domains are contacted and why. If you want, I can: - Extract and list every external domain/endpoints the skill calls from server.py and SKILL.md, and - Produce a minimal checklist of commands to run in a disposable container to validate behavior safely.

Type: OpenClaw Skill Name: video-download-transcribe Version: 3.2.1 The skill bundle exhibits high-risk behavior by using `subprocess.run` to execute shell commands and dynamically constructed Python scripts for video processing and browser automation. It contains hardcoded absolute paths (e.g., `/Users/kk/...` in `server.py` and `setup.sh`) and instructs the AI agent to perform local system configurations and execute shell scripts. While these actions are aligned with the stated purpose of video downloading and transcription, the reliance on external binaries (yt-dlp, ffmpeg, Playwright) and the construction of sub-processes via string interpolation in `server.py` create a significant attack surface for potential command or script injection.