📦 YouTube Long Video Transcript — 长视频转录翻译
v1.0.0一键提取>1小时YouTube完整字幕，支持英译中，自动分段处理超长视频，调用DownSub API并输出格式化文档。
0· 973·1 当前·1 累计
by 下载技能包
最后更新
2026/3/1
安全扫描
OpenClaw
可疑
medium confidenceThe instructions require a DownSub API key (and even embed a bearer token) and ask the agent to spawn sub-agents and read/write transcript files, but the skill metadata declares no credentials or requirements — these inconsistencies are suspicious and should be checked before installing.
评估建议
Do not install blindly. Key points to check before proceeding:
- The SKILL.md requires a DownSub API key yet the registry metadata lists no credentials — confirm where/how you'll provide the API key and avoid pasting secrets into plain instructions. Prefer storing keys in your platform's secrets store.
- The document embeds an Authorization header with a bearer token (starts with 'AIza...'); treat this as suspicious (possible accidental leak or placeholder). Do not assume the embedded token is v...详细分析 ▾
⚠ 用途与能力
The skill's name/description (YouTube long-video transcription & translation) matches the SKILL.md workflow, but the metadata declares no required credentials or tools while the instructions explicitly require a DownSub API key and optional 'zhiyan' tool. The SKILL.md even embeds an Authorization header with a bearer token, which is inconsistent with the registry metadata and unexpected for a simple instruction-only skill.
⚠ 指令范围
Runtime instructions tell the agent to POST to https://api.downsub.com/download with a specific Authorization header (token-looking string starting with 'AIza...'), spawn sub-agents, read and slice large transcript files, append/write chunk files, and optionally call a 'zhiyan' MCP. The instructions contain contradictions (e.g., earlier 'Has zhiyan? → Can generate online docs' vs. spawn-task text 'Do NOT use zhiyan') and include a hard-coded credential in the document — both are red flags. The steps ask the agent to handle secrets and to spawn background processing, which broadens the surface area beyond a simple parser.
✓ 安装机制
No install spec and no code files are present (instruction-only). This lowers the risk from disk-installed arbitrary code. However, being instruction-only means the SKILL.md itself is the primary security surface and must be trusted.
⚠ 凭证需求
The skill metadata lists no required environment variables or primary credential, yet the SKILL.md requires a DownSub API key and shows an Authorization header with a token pattern ('AIza...') typically associated with Google API keys. Requiring a bearer/API key is reasonable for a third‑party service, but the metadata should declare it and the embedded token in the instructions is problematic. The skill also asks the user to 'configure in secrets' with no guidance on scope or storage.
✓ 持久化与权限
The skill does not request persistent installation or 'always' inclusion and does not ask to modify other skills or system-wide settings. It does instruct spawning sub-agents and writing local files (transcript chunks and merged outputs), which is expected for long-file processing but increases operational privileges at runtime; this is a normal but notable capability.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/10
YouTube long video (>1hr) transcription and Chinese translation workflow
● 无害
安装命令
点击复制官方npx clawhub@latest install ytb-transcript-long
镜像加速npx clawhub@latest install ytb-transcript-long --registry https://cn.longxiaskill.com