by 安全扫描
OpenClaw
安全
medium confidence该技能的代码和指令与其声明的目的（使用 yt-dlp 和 ffmpeg 下载和操作视频）一致，但在安装前应审查几个小的遗漏和隐私问题。
评估建议
该技能似乎做了它声称的：使用 yt-dlp 下载视频并使用 ffmpeg 操作。安装前，请考虑：1) 隐私/数据外流 — SKILL.md 建议将提取的帧发送到视觉模型，但未指定模型；确保您信任将接收这些图像的代理或模型。2) 本地存储 — 下载的视频和帧缓存在 `/tmp/vidiq/`；使用后删除敏感文件。3) 未声明的依赖项 — 脚本除了使用 ffmpeg/yt-dlp，还使用了 python3、md5sum、bc、awk、grep、sed；确保您的环境提供了这些依赖。4) 版权和带宽 — 下载视频可能违反条款或消耗网络/磁盘。如果您想要更严格的保证，请请求作者在元数据中添加关于帧数据发送位置的明确声明并列出所有所需的二进制文件。...详细分析 ▾
✓ 用途与能力
Name/description match the included script: the shell script uses yt-dlp to download videos and ffmpeg/ffprobe to inspect, extract frames, clip, create GIFs, etc. The requested binaries (ffmpeg, yt-dlp) are the core tools needed. Minor mismatch: the script also invokes common utilities (python3, md5sum, bc, awk, grep, sed) that are not listed in the metadata but are typical on many systems.
ℹ 指令范围
SKILL.md tells the agent to 'feed frames to a vision model for content understanding' but does not specify which model or endpoint; the script itself only writes frames to /tmp/vidiq and does not transmit them. This leaves it to the agent runtime to decide where frames are sent, which could result in external transmission of image data if the agent forwards frames to a remote service. Also: SKILL.md lists a 'transcript' action in usage comments, but the script has no implemented 'transcript' case.
✓ 安装机制
No install spec (instruction-only with an included shell script). This is low-risk from an installation perspective because no external code is fetched during install. Runtime does call yt-dlp which downloads video content (expected behaviour).
✓ 凭证需求
The skill declares no required environment variables or credentials, which is appropriate for a local video manipulation tool. It does perform network downloads of user-supplied URLs via yt-dlp — expected for the feature, but note that any URL the agent is given will be fetched.
✓ 持久化与权限
The skill does not request persistent/always-on privileges. It writes temporary files under /tmp/vidiq for caching and frames, which is normal for this functionality but means downloaded content is stored locally.
⚠ scripts/vidiq.sh:82
Dynamic code execution detected.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/9
初始发布 — 视频下载、帧、剪辑、GIF、马赛克、AI 分析
● 可疑
安装命令 点击复制
官方npx clawhub@latest install vidiq
镜像加速npx clawhub@latest install vidiq --registry https://cn.clawhub-mirror.com
技能文档
下载、理解和操作任意 URL 的视频。
命令
# 视频信息（时长、分辨率、编码器）
{baseDir}/scripts/vidiq.sh info
# 提取 N 帧，均匀间隔
{baseDir}/scripts/vidiq.sh frames 10
# 单帧，指定时间戳
{baseDir}/scripts/vidiq.sh frame 01:30:00
# 在时间戳之间剪辑
{baseDir}/scripts/vidiq.sh clip 01:01:01 01:20:01 output.mp4
# 创建 GIF（开始时间，秒数）
{baseDir}/scripts/vidiq.sh gif 00:45:00 5
# 提取音频为 MP3
{baseDir}/scripts/vidiq.sh audio
# 检测场景变化
{baseDir}/scripts/vidiq.sh scenes 0.3
# 视觉马赛克（列数，总帧数）
{baseDir}/scripts/vidiq.sh mosaic 4 16
AI 分析工作流
- 提取帧：
vidiq.shframes 10 - 将帧输入视觉模型进行内容理解
- 基于帧分析回答关于视频的问题
支持平台
YouTube, TikTok, Instagram, X/Twitter, 任意直接视频 URL, 本地文件。注意事项
- 下载的视频缓存在
/tmp/vidiq/以供重用 - 帧输出到
/tmp/vidiq/frames_*/ - 对于长视频，提取更多帧以获得更好的覆盖
- GIF 通过调色板生成以获得小文件大小
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制