Video News Downloader

Automated daily news video downloader with AI subtitle proofreading. Downloads CBS Evening News and BBC News at Ten from YouTube, extracts and proofreads sub...

This skill is functional but has a few red flags you should consider before using it: - Privileged paths and crontab: The scripts operate under /root/.openclaw/workspace and the cron installer edits the user's crontab. Only run the cron installer if you understand and accept these persistent system changes and you run the agent as the expected user. Inspect any cron lines before installing. - Network exposure: setup_server.sh starts two HTTP servers bound to 0.0.0.0 on ports 8093 and 8095 (no auth). If you run this on a network-accessible host, these servers will expose video files publicly. If you want local-only access, modify the bind address or use firewall rules. - Missing declared dependencies: The code calls yt-dlp and python3 http.server but the skill metadata does not declare required binaries. Ensure yt-dlp is installed and up-to-date before running; test downloads manually first. - DeepSeek is not integrated automatically: subtitle_proofreader.py only generates a proofreading prompt file (it does NOT call an API or send data to an external DeepSeek endpoint). If you expect fully automated AI corrections, you'll need to wire in an API or model runner and consider how API keys/credentials are stored and used. - Run in isolation first: Because the scripts write files in root paths, modify crontab, and open network ports, consider running the skill in a container, VM, or dedicated account with limited privileges. Review and, if needed, modify the scripts to use non-root workspace paths, bind servers to localhost, and preview cron entries before installing. If you want, I can produce a safer checklist or a modified version of the setup scripts to avoid binding to 0.0.0.0 and to use a non-root workspace and explicit dependency checks.

Type: OpenClaw Skill Name: video-news-downloader Version: 1.0.0 The skill is classified as suspicious due to its use of high-risk capabilities that modify the system and expose network services. Specifically, `scripts/setup_cron.sh` installs persistent cron jobs, and `scripts/setup_server.sh` starts HTTP servers binding to `0.0.0.0` on ports 8093 and 8095, making them network-accessible. While these actions are explicitly part of the skill's stated purpose (automated downloads and local video streaming) and there is no evidence of intentional malicious behavior like data exfiltration or unauthorized remote control, these capabilities represent a significant security risk if the environment were compromised or if the skill's scripts were altered.