Video Transcript Downloader

Download videos, audio, subtitles, and clean paragraph-style transcripts from YouTube and any other yt-dlp supported site. Use when asked to “download this video”, “save this clip”, “rip audio”, “get subtitles”, “get transcript”, or to troubleshoot yt-dlp/ffmpeg and formats/playlists.

Install only if you are comfortable with a skill that can run yt-dlp/ffmpeg and save remote media locally. Review every command before execution, choose output directories deliberately, and do not let untrusted page content or prompts supply extra yt-dlp arguments after --, especially options that execute commands or change output paths.

Type: OpenClaw Skill Name: video-transcript-downloader Version: 1.0.0 The skill is classified as suspicious due to its use of `node:child_process.spawn` to execute external binaries (`yt-dlp`, `ffmpeg`) and, critically, its explicit forwarding of arbitrary user-supplied arguments (`opts.extra`) directly to `yt-dlp` in `scripts/vtd.js`. This passthrough mechanism, documented in `SKILL.md`, allows for command injection into `yt-dlp`'s powerful `--exec` option, which could lead to arbitrary code execution if the AI agent is prompted to pass malicious arguments. While this capability is plausibly needed for advanced `yt-dlp` usage, it significantly increases the attack surface for prompt injection against the agent, making it a risky capability without clear malicious intent from the skill itself.