安全扫描
OpenClaw
可疑
medium confidenceThe skill's code and docs match its stated purpose (syncing Chrome YouTube cookies and setting up a server-side yt-dlp -> ffmpeg flow), but there are inconsistencies and sensitive behaviors (cookie exfiltration, an undeclared bearer-token requirement, and missing referenced files) that warrant caution before use.
评估建议
This skill appears to do what it says (enable Windows->server cookie sync and a yt-dlp+ffmpeg fallback), but take these precautions before installing or running it:
- Understand the sensitive action: youtube_cookie_sync.py exports local browser cookies and uploads them to a server. Only run this on machines and profiles you trust and with explicit user consent. Do not use production browser profiles unless you fully trust the receiving server.
- Verify and restrict the server endpoint: review a...详细分析 ▾
ℹ 用途与能力
The skill's files (install script and cookie-sync script) align with the described goal of syncing Windows Chrome cookies to a server and enabling yt-dlp/ffmpeg downloads. However, the SKILL.md references additional helper Windows scripts that are not present in the file manifest and the skill metadata declares no required env vars even though the workflow expects MEOW_SERVER_URL and MEOW_BEARER_TOKEN.
ℹ 指令范围
Runtime instructions explicitly tell an operator/agent to export local browser cookies and POST them to a remote server endpoint. That behavior is consistent with the intended purpose but is inherently sensitive: it reads local browser cookie material and transmits it to an external server. The instructions do not attempt to read unrelated system files, but they do assume permission to modify repos and server code (patching an existing service) which can have broad impact if done automatically.
✓ 安装机制
There is no opaque or remote install step embedded in the skill bundle itself. The provided install_server_env.sh bootstraps a Debian/Ubuntu host using official NodeSource, apt, pip, and npm sources (nodesource.com, pip, npm). These are standard and proportionate to installing yt-dlp, yt-dlp-ejs and ffmpeg.
⚠ 凭证需求
The package metadata declares no required environment variables, but both documentation and scripts rely on MEOW_SERVER_URL and MEOW_BEARER_TOKEN (the python script will exit if token is missing). Requesting a bearer token and a server URL is reasonable for the cookie-upload workflow, but the omission from declared requirements is an inconsistency and reduces transparency. The skill does not request unrelated cloud credentials or wide-ranging secrets.
✓ 持久化与权限
The skill is instruction-only with no 'always' privilege. It does not request persistent, system-wide configuration changes beyond advising edits to the target repo and writing a youtube-cookies.txt file on the server (server-side handler in docs writes to ./youtube-cookies.txt). There is no indication it would modify other skills or agent configs.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/3/27
First public release: YouTube MV to MP3 workflow, cookie sync, server env setup, old-source-first + YouTube fallback guidance.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install meowmusic-youtube-mp3
镜像加速npx clawhub@latest install meowmusic-youtube-mp3 --registry https://cn.clawhub-mirror.com
技能文档
Use this skill to rebuild the currently working MeowMusicServer-patched solution into another repo/server without rediscovering the whole stack.
Workflow decision tree
- Need cookie sync from Windows Chrome to server?
scripts/youtube_cookie_sync.py.
- If the user wants a double-click workflow on Windows, also use scripts/windows/sync_cookie.bat and scripts/windows/open_youtube.bat.
- If you need API shape or server handler details, read references/cookie-api-and-sync.md.- Need to prepare a Linux server for YouTube download and MP3 extraction?
scripts/install_server_env.sh.
- If challenge solving or runtime behavior is flaky, read references/server-runtime-notes.md.- Need to patch MeowMusicServer so old sources stay first and YouTube acts only as fallback/补源?
references/meowmusic-integration.md.
- Keep source priority as: sources.json → local library → cache → legacy upstreams → YouTube fallback.
- Do not make YouTube the default first source unless the user explicitly asks.- Need MV -> MP3 instead of direct streaming?
yt-dlp to fetch bestaudio, then use ffmpeg to normalize/transcode into a stable cached music.mp3.
- Read references/meowmusic-integration.md for the patch pattern and command shape.Core operating rules
- Prefer old/legacy music sources first. YouTube is a补源/fallback path, not the primary path.
- Prefer local reusable cache/library over repeated redownloads.
- Prefer returning a stable cached
music.mp3path to devices instead of a fragile live stream. - If a cookie file exists, pass it to
yt-dlpautomatically. - When YouTube requires extra handling, prefer extractor args compatible with the known-good setup:
youtube:player_client=tv,web;formats=missing_pot
- youtube:player_skip=webpage,configs
- Keep all cookie and bearer-token material out of the skill package. Use placeholders only.
Recommended implementation shape
1. Windows cookie sync
On Windows, export cookies from Chrome with:
yt-dlp --cookies-from-browser chrome:Default --cookies youtube-cookies.txt --skip-download https://www.youtube.com/watch?v=dQw4w9WgXcQ
Then POST the cookie file content to a server endpoint such as:
POST /api/admin/youtube-cookie/update- optional status check:
GET /api/admin/youtube-cookie/status
Use scripts/youtube_cookie_sync.py unless the repo already has its own equivalent.
2. Server download strategy
Use this shape:
- Search top YouTube MV/result for a song.
- Download audio with
yt-dlpinto a per-track cache directory. - Convert the downloaded source into
music.mp3withffmpeg. - Return cached local URLs from the service.
3. MeowMusic source order
Use this order unless the user asks otherwise:
- curated
sources.json - local uploaded/downloaded library
- existing cache hits
- legacy remote music APIs
- YouTube fallback
This keeps the product aligned with the current direction: local-first, old-source-first, YouTube only for missing tracks.
Files in this skill
scripts/install_server_env.sh— server bootstrap for Node 22, yt-dlp, yt-dlp-ejs, ffmpeg.scripts/youtube_cookie_sync.py— export Chrome/Edge/Firefox cookies and push them to the server.scripts/windows/sync_cookie.bat— Windows double-click wrapper.scripts/windows/open_youtube.bat— helper to open YouTube in Chrome.references/cookie-api-and-sync.md— cookie API contract and usage notes.references/server-runtime-notes.md— server environment and challenge-solver notes.references/meowmusic-integration.md— patch strategy and concrete Go snippets.
Execution notes
- Read only the reference file relevant to the current task.
- When editing an existing repo, prefer minimal surgical patches over broad rewrites.
- When a download path already works, preserve behavior and only harden the flaky parts.
- If the target repo differs from MeowMusicServer, reuse the flow, not the exact filenames.
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制