by 安全扫描
OpenClaw
安全
medium confidenceThe code, instructions, and requirements align with a multi-platform video downloader; nothing obvious indicates covert data exfiltration or unrelated privileges, but browser automation and third-party installs warrant caution.
评估建议
This skill appears to do what it says: download videos using yt-dlp or browser automation. Before installing and running it: (1) prefer running inside a container (Docker) or isolated environment to limit filesystem/network access; (2) be aware DrissionPage will auto-download a Chromium binary and will run a real browser session — don't use browser mode with URLs that require sensitive cookies, or from inside networks you don't want probed; (3) pip installs from PyPI are normal but carry supply-...详细分析 ▾
✓ 用途与能力
Name/description, SKILL.md, and the Python script all consistently implement a multi-platform video downloader using yt-dlp and DrissionPage. There are no unrelated environment variables, binaries, or config paths requested.
ℹ 指令范围
SKILL.md only instructs building a Docker image or installing Python deps and running the script. The runtime instructions and code perform network requests, spawn yt-dlp subprocesses, and use browser automation to fetch pages and video URLs. That behavior is expected for this purpose, but browser automation will execute arbitrary JavaScript on visited pages and can access resources reachable from the host (including local network endpoints or any authenticated browser session/cookies), so users should avoid passing sensitive internal URLs or credentials.
ℹ 安装机制
No packaged install spec; the README recommends pip installs (yt-dlp, DrissionPage). Installing from PyPI is typical but carries the usual supply-chain risk. DrissionPage will auto-download a Chrome/Chromium binary at runtime (as noted in docs), which pulls a large executable from the network — expected for browser automation but worth noting.
✓ 凭证需求
The skill requests no environment variables or credentials. The code writes downloaded media and metadata to disk in the chosen output directory; it does not require unrelated secrets or system credentials.
✓ 持久化与权限
Skill is not always-enabled and does not request elevated or persistent platform privileges. It does not modify other skills' configs. Its persistence is limited to writing downloaded files and metadata in the output directory.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/15
Initial release: Universal video downloader supporting Douyin, Bilibili, YouTube, TikTok and more platforms with automatic platform detection and multiple download methods
● 可疑
安装命令
点击复制官方npx clawhub@latest install multi-platform-video-downloader
镜像加速npx clawhub@latest install multi-platform-video-downloader --registry https://cn.longxiaskill.com镜像同步中