video-understand

Analyze and understand video content using AI. Upload local files, YouTube URLs, or HTTP video URLs for detailed analysis, Q&A, and timestamped breakdowns.

Before installing or using this skill, consider the following: - Metadata mismatch: the registry claims no required env vars or binaries, but the docs require GEMINI_API_KEY or MOONSHOT_API_KEY, Node.js/npm, and optionally yt-dlp. Treat that as a red flag and verify the package source. - Verify the npm package: inspect the video-understand package on npm/GitHub (source code, maintainer, recent publishes) before running npm install -g; prefer installing from a source you trust. - Credential safety: the skill stores API keys (or reads env vars) and will upload video content to third‑party providers. Only provide keys for providers you trust and avoid uploading sensitive video content. - yt-dlp dependency: if you plan to use Kimi with YouTube, the skill relies on an external downloader (yt-dlp) which is not declared in the registry metadata—install that from an official package source and be cautious when running downloads. - Local files and cache: it creates ~/.video-understand/config.json and uploads cache; review and remove cached files if they contain sensitive material. - If you need higher assurance: request the skill's source code or the npm package tarball to review what it does locally (especially any code that would upload files or persist keys). If you cannot verify the package source, treat the skill as untrusted. If you plan to proceed, limit the API key scope (if supported), avoid uploading sensitive videos, and inspect the installed CLI's code before giving it credentials.

Type: OpenClaw Skill Name: video-understand Version: 1.0.1 The skill is classified as suspicious due to its reliance on external command execution and network requests, which introduce potential vulnerabilities. Specifically, the `SKILL.md` and `rules/install.md` files indicate that the Kimi provider downloads YouTube videos using `yt-dlp` and other HTTP videos via `fetch`. While `yt-dlp` is a legitimate tool, passing user-controlled URLs to an external command like `yt-dlp` without robust sanitization could lead to shell injection vulnerabilities. Although the `SKILL.md` includes a commendable warning against prompt injection from video content, the underlying mechanism of invoking external tools with potentially untrusted input remains a risk.