by 安全扫描
OpenClaw
安全
high confidenceThe skill's files, installer script, and runtime instructions are internally consistent with a Windows-local video/audio processing helper that installs a VN Tools CLI from a GitHub release and runs on local files.
评估建议
This skill appears to be what it claims: a Windows-local helper that installs a VN Tools CLI from a GitHub release and processes local media. Before installing, confirm you trust the GitHub repo (cawcut/skill-vn) and the specific release binary (MSI). The installer will download an MSI and run msiexec, and the CLI may download large model files (Whisper ggml models) at first use — so expect outbound downloads and disk usage. If you need strictly offline operation or cannot trust third-party bina...详细分析 ▾
✓ 用途与能力
Name/description (local VN Video Editor tooling) matches the included artifacts: an instruction-only SKILL.md describing vn-tools-cli commands and a PowerShell installer that downloads and installs a VN Tools CLI MSI from a GitHub releases URL. Required capabilities (local file paths, Windows-only) are appropriate for the stated purpose.
ℹ 指令范围
SKILL.md limits actions to local file processing, requires absolute Windows paths, and provides command examples for vn-tools-cli. It does note that some transcription models are "one-time downloads on first use" (Whisper ggml models) but does not document the download endpoints for those model files; this is expected for a local CLI but means the tool will perform network downloads at runtime (to fetch models) even though it claims "no cloud upload" of user media.
✓ 安装机制
The included installer script downloads an MSI from a GitHub releases URL (https://github.com/cawcut/skill-vn/releases/...), verifies curl.exe is present, and runs msiexec per-user (/qn, MSIINSTALLPERUSER). Downloading from a GitHub releases URL is a standard, traceable mechanism. The installer writes to TEMP and per-user program locations; no obfuscated or shortener URLs are used.
✓ 凭证需求
The skill declares no required environment variables, credentials, or config paths. The installer and CLI operate on user-supplied local file paths. There are no demands for unrelated tokens/keys or broad environment access in the provided files.
✓ 持久化与权限
The skill is user-invocable, not always-enabled. The installer performs a normal per-user MSI installation and writes a small version file; it does not modify other skills or system-wide agent settings. No elevated privileges are required (it checks for admin but installs per-user).
安全有层次，运行前请审查代码。
运行时依赖
🖥️ OSWindows
版本
latestv0.1.02026/4/22
Initial release — auto-captions, burn SRT, compress, denoise, extract, merge, video cutout; local processing on Windows via VN Tools CLI (auto-installed)
● 可疑
安装命令
点击复制官方npx clawhub@latest install vn-skill-for-windows
镜像加速npx clawhub@latest install vn-skill-for-windows --registry https://cn.longxiaskill.com