video-remix

YouTube 视频处理助手 - Gemini 智能分析 + 下载 + 剪辑 + 配音 + 硬字幕合成 + 局域网 HTTP 分享

This package appears to implement the advertised video download→transcribe→analyze→TTS→merge flow, but there are privacy-exposing details you should consider before installing or running it: - Browser profile risk: SKILL.md tells the agent to start a browser with profile "openclaw" and automate Gemini. That will use whatever cookies, sessions, and credentials are present in that profile (including any logged-in Google account). If you don't want your Google session or other profile data used, do not run with an existing profile — run with a fresh/ephemeral profile or in an isolated VM/container. - Autonomy and triggers: The skill is written to auto-trigger on specific keywords. If you enable auto-invocation, the agent may run the Gemini automation and downloads without an explicit per-run approval. Prefer explicit user invocation unless you trust it. - LAN sharing: The skill promises HTTP sharing on the LAN. Inspect the scripts that start servers to ensure they bind only to localhost or are protected; otherwise files could be exposed to your network. - LLM credentials and data exfiltration: The skill will send the YouTube URL and generated prompts to Gemini (via browser) and may also call OpenAI/Anthropic/local endpoints if configured. Be aware that transcripts and prompts (including video content/context) will be transmitted to those services. If you must keep content private, do not use remote LLMs or run the tool offline. - Running commands: The code invokes system binaries (yt-dlp, ffmpeg, whisper/faster-whisper, edge-tts). Review the download and encoding commands and ensure you install trusted builds (especially ffmpeg with libass) from your OS package manager or trusted taps. - Safety checklist before running: (1) Review the full scripts (video_remix.py, gemini_first_remix.py) to see exact network endpoints and any HTTP servers started; (2) Run inside an isolated environment (container/VM) or with a fresh browser profile; (3) Do not supply any API keys unless you understand how/where they're used and stored; (4) Confirm legal/compliance implications of downloading YouTube content. If you want, I can scan the remaining truncated files (scripts) for any code that starts a network listener, posts data to external endpoints, or persists secrets, and produce a tighter list of lines to inspect.

Type: OpenClaw Skill Name: video-remix Version: 1.0.7 The skill bundle implements a comprehensive video processing pipeline including YouTube downloading, browser-based AI analysis, and local file sharing. It is classified as suspicious due to several high-risk capabilities: it instructs the agent to perform system-level package installations (e.g., `sudo apt install` in `SKILL.md`), utilizes browser automation to scrape content from Gemini, and launches a local HTTP server (`scripts/gemini_first_remix.py`) to expose the workspace to the local network. While these behaviors are aligned with the stated goal of automated video editing and sharing, the combination of shell execution, remote content fetching, and network service hosting creates a significant attack surface.