VidIQ - Video Intelligence

AI-powered video intelligence - download, analyze, clip, GIF from any URL. Supports YouTube, TikTok, Instagram, X. Uses ffmpeg + yt-dlp.

This skill appears to do what it says: it downloads videos via yt-dlp and manipulates them with ffmpeg. Before installing, consider: 1) Privacy/exfiltration — the SKILL.md suggests sending extracted frames to a vision model but doesn't specify which; ensure you trust the agent or model that will receive those images. 2) Local storage — downloads and frames are cached under /tmp/vidiq; remove sensitive files after use. 3) Undeclared dependencies — the script uses python3, md5sum, bc, awk, grep, sed in addition to ffmpeg/yt-dlp; ensure your environment provides these. 4) Copyright and bandwidth — downloading videos may violate terms or consume network/disk. If you want tighter guarantees, request the author add explicit statements about where frame data is sent and list all required binaries in metadata.

Type: OpenClaw Skill Name: vidiq Version: 1.0.0 The skill bundle provides legitimate video processing functionality using ffmpeg and yt-dlp, but contains a security vulnerability in `scripts/vidiq.sh`. Specifically, it uses the Python `eval()` function to process the `r_frame_rate` metadata field extracted by `ffprobe` from potentially untrusted video files. While this appears to be an unintentional coding flaw rather than intentional malice, it represents a potential code execution vector if a crafted video file can influence the ffprobe output.