Youtube Editor

Automate YouTube video editing: download videos, transcribe with Whisper, analyze content using GPT-4, and create Korean SEO-optimized metadata plus consiste...

Before installing or running this skill: 1) Expect to provide your OPENAI_API_KEY (required for transcription and GPT). The registry metadata does not declare this — the discrepancy is suspicious. 2) Install FFmpeg and the optional Python dependencies (playwright, rembg) if you want thumbnails. 3) The skill can call a separate nano-banana-pro script via fixed paths; only allow that if you trust the nano-banana-pro skill source (review its code). 4) The script writes files (transcripts, HTML, PNG) and reads your avatar/font files — don’t run it on machines with sensitive local data unless you audited the script. 5) If you’re not comfortable auditing the code or the external nano-banana-pro skill, treat this as untrusted and do not provide API keys or run on private videos. If you want higher assurance, ask the author to update the registry metadata to declare required env vars and system dependencies and to document exactly which external scripts it will execute.

Type: OpenClaw Skill Name: youtube-editor Version: 1.0.14 The skill is classified as suspicious due to a local HTML injection (XSS) vulnerability in `scripts/process_video.py`. The `avatar_path` argument, which can be user-controlled, is directly embedded into an `<img>` tag's `src` attribute within an HTML template without proper HTML escaping. This could allow a malicious user to inject arbitrary JavaScript into the locally rendered HTML, which is then processed by Playwright. While the skill demonstrates good security practices like YouTube URL validation and safe subprocess execution for other features, this specific input sanitization oversight presents a vulnerability.