安全扫描
OpenClaw
可疑
high confidenceThe skill largely does what it says (download Xiaohongshu video, extract audio, send to Poe/Gemini for transcription, and summarize), but its metadata omits the required POE_API_KEY and there are a few operational details you should verify before installing.
评估建议
This skill appears to implement the stated Xiaohongshu video → audio → Poe/Gemini transcription → summary flow, but double-check these before installing: (1) The published metadata omitted POE_API_KEY even though SKILL.md and the scripts require it — confirm you are comfortable the skill will read $POE_API_KEY or ~/.openclaw/openclaw.json. (2) The skill will upload audio to api.poe.com (a third‑party transcription service) — avoid using it with sensitive or private audio unless you trust the ser...详细分析 ▾
✓ 用途与能力
Name/description match the code and instructions: scripts download a Xiaohongshu video, extract audio (ffmpeg/yt-dlp), and send audio to the Poe API (Gemini) for transcription and summarization. There are no unrelated cloud credentials or unexpected services requested.
✓ 指令范围
SKILL.md and scripts describe and implement the expected workflow. The shell script and Python downloader operate only on the provided URL/work directory. The agent is instructed to send audio files to api.poe.com for transcription, which matches the stated design. The scripts read ~/.openclaw/openclaw.json as a fallback for POE_API_KEY.
✓ 安装机制
No install spec is present (instruction-only with included scripts). No remote download/install of arbitrary code occurs; only local scripts are run. This is low-risk from an install mechanism standpoint.
⚠ 凭证需求
Metadata lists no required env vars, but both SKILL.md and scripts require a POE_API_KEY (or an entry in ~/.openclaw/openclaw.json). This mismatch is a meaningful omission: the skill will attempt to read the API key from your home config file or environment and will send audio data to Poe. The number and type of credentials requested (a single Poe API key) are proportionate to the task, but the omission from metadata is an incoherence that should be fixed/confirmed before use.
✓ 持久化与权限
The skill does not request always:true and does not modify other skills or system-wide settings. It runs transiently and writes outputs to a working directory (default /tmp/xhs-analysis-<ts>), which is expected behavior.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/10
No changes detected in this version. - Version 1.0.1 contains no modifications from the previous release.
● 无害
安装命令 点击复制
官方npx clawhub@latest install xhs-video-analyzer
镜像加速npx clawhub@latest install xhs-video-analyzer --registry https://cn.clawhub-mirror.com
技能文档
下载小红书视频并提取语音内容进行总结。
快速使用
当用户提供小红书链接时,执行以下流程:
~/.openclaw/skills/xhs-video-analyzer/scripts/full-analyze.sh "https://www.xiaohongshu.com/explore/..."
工作流程
- 下载视频 - 使用 Python 脚本或 yt-dlp
- 提取音频 - 使用 ffmpeg
- 语音转文字 - 使用 Poe API + Gemini (云端转录)
- 详细总结 - 基于转录文本生成深度分析报告
依赖
ffmpeg- 提取音频curl- API 请求Poe API Key- 需要配置 POE_API_KEY 环境变量或在 ~/.openclaw/openclaw.json 中配置
API 配置
在 ~/.openclaw/openclaw.json 中配置 Poe API:
{
"models": {
"providers": {
"poe": {
"baseUrl": "https://api.poe.com/v1",
"apiKey": "YOUR_POE_API_KEY"
}
}
}
}
或设置环境变量:
export POE_API_KEY="your-api-key"
转录技术
使用 Poe API 的 file 格式发送音频到 Gemini 模型进行转录:
{
"type": "file",
"file": {
"filename": "audio.mp3",
"file_data": "data:audio/mp3;base64,"
}
}
输出
- 视频文件:
video.mp4 - 音频文件:
audio.mp3 - 转录文本:
audio.txt - 音频片段:
chunks/(3分钟一个片段)
详细总结指南
转录完成后,必须对转录文本进行深度分析和详细总结。总结应包含以下内容:
总结结构
- 视频主题 - 一句话概括视频的核心话题
- 核心观点 - 提取视频中的主要论点和见解(3-5条)
- 详细内容分解 - 按话题/章节拆解视频内容,每个部分包含:
- 实用价值 - 视频对观众的实际帮助或启发
- 关键金句 - 摘录视频中有价值的原话(2-3句)
总结原则
- 详尽而非简略 - 不要只列出要点,要展开说明每个观点的具体内容
- 保留原意 - 准确传达讲述者的观点,不要过度概括导致信息丢失
- 结构清晰 - 用标题、列表、引用等方式组织内容,便于阅读
- 突出价值 - 强调视频中对观众有实际帮助的信息和建议
- 语言自然 - 使用流畅的中文表达,避免机械式罗列
示例格式
\\\
视频主题
[一句话概括]
核心观点
- [观点1] - [具体解释]
- [观点2] - [具体解释]
- [观点3] - [具体解释]
详细内容
[子话题1]
[详细说明内容,包括背景、论据、案例等][子话题2]
[详细说明内容,包括背景、论据、案例等][子话题3]
[详细说明内容,包括背景、论据、案例等]实用价值
- [对观众的实际帮助1]
- [对观众的实际帮助2]
关键金句
"[原话摘录1]"\\
"[原话摘录2]"
\分析完成后,先输出转录文本的详细总结,再提及工作目录信息。
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制