小红书视频下载器

Download and summarize Xiaohongshu (小红书/RedNote) videos. Produces a full resource pack with video, audio, subtitles, transcript, and AI summary. This skill s...

This skill appears to do what it says: download Xiaohongshu videos and produce transcripts and a Claude-based summary. Before installing or running it, consider the following: - Browser cookies: yt-dlp's --cookies-from-browser will access your browser's cookie store to authenticate. Only use this if you understand/consent to that access and avoid running on a machine with other sensitive logged-in sessions you don't want accessed. - Dependencies & resource use: faster-whisper and model weights are large and may be installed from PyPI. Run in a dedicated Python virtualenv, and be prepared for substantial CPU/RAM/disk usage for transcription. - Run untrusted code safely: inspect the two scripts (they are included and readable) before running. If unsure, run them in an isolated environment (container or throwaway VM) and do not run as root. - Legal/terms: ensure you have the right to download the content and that you comply with Xiaohongshu's terms of service and copyright law. - Inputs: avoid pasting untrusted or malicious URLs; the scripts pass URL arguments directly to yt-dlp but use list-style subprocess calls (not shell), which reduces but does not eliminate risk. If you want greater assurance, ask the publisher for provenance (homepage, author contact) or run the scripts in a sandboxed environment and verify yt-dlp behavior on a test public URL first.

Type: OpenClaw Skill Name: xiaohongshu-downloader Version: 1.0.0 The skill's core functionality to download and process videos is implemented securely, using `subprocess.run` with lists to prevent shell injection vulnerabilities in `scripts/download_xiaohongshu.py` and `scripts/parallel_transcribe.py`. However, the skill is classified as 'suspicious' due to the inherent prompt injection vulnerability against the AI agent's LLM component. The `SKILL.md` instructions explicitly direct the agent to read user-controlled content (video title and transcript from `~/Downloads/<video title>/transcript.txt` and `.meta.json`) and insert it into a prompt template (`reference/summary-prompt.md`) for AI summary generation. This creates a surface where malicious input in the video title or transcript could manipulate the LLM's behavior, even though the skill itself does not contain malicious intent or exploit this vulnerability.