安全扫描
OpenClaw
可疑
medium confidenceThe skill's code and docs match its stated purpose (syncing Chrome YouTube cookies and setting up a server-side yt-dlp -> ffmpeg flow), but there are inconsistencies and sensitive behaviors (cookie exfiltration, an undeclared bearer-token requirement, and missing referenced files) that warrant caution before use.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/3/26
First public release: YouTube MV to MP3 workflow, cookie sync, server env setup, old-source-first + YouTube fallback guidance.
● 可疑
安装命令
点击复制官方npx clawhub@latest install meowmusic-youtube-mp3
🇨🇳 镜像加速npx clawhub@latest install meowmusic-youtube-mp3 --registry https://cn.longxiaskill.com
技能文档
Use this skill to rebuild the currently working MeowMusicServer-patched solution into another repo/server without rediscovering the whole stack.
Workflow decision tree
- Need cookie sync from Windows Chrome to server?
scripts/youtube_cookie_sync.py.
- If the user wants a double-click workflow on Windows, also use scripts/windows/sync_cookie.bat and scripts/windows/open_youtube.bat.
- If you need API shape or server handler details, read references/cookie-api-and-sync.md.- Need to prepare a Linux server for YouTube download and MP3 extraction?
scripts/install_server_env.sh.
- If challenge solving or runtime behavior is flaky, read references/server-runtime-notes.md.- Need to patch MeowMusicServer so old sources stay first and YouTube acts only as fallback/补源?
references/meowmusic-integration.md.
- Keep source priority as: sources.json → local library → cache → legacy upstreams → YouTube fallback.
- Do not make YouTube the default first source unless the user explicitly asks.- Need MV -> MP3 instead of direct streaming?
yt-dlp to fetch bestaudio, then use ffmpeg to normalize/transcode into a stable cached music.mp3.
- Read references/meowmusic-integration.md for the patch pattern and command shape.Core operating rules
- Prefer old/legacy music sources first. YouTube is a补源/fallback path, not the primary path.
- Prefer local reusable cache/library over repeated redownloads.
- Prefer returning a stable cached
music.mp3path to devices instead of a fragile live stream. - If a cookie file exists, pass it to
yt-dlpautomatically. - When YouTube requires extra handling, prefer extractor args compatible with the known-good setup:
youtube:player_client=tv,web;formats=missing_pot
- youtube:player_skip=webpage,configs
- Keep all cookie and bearer-token material out of the skill package. Use placeholders only.
Recommended implementation shape
1. Windows cookie sync
On Windows, export cookies from Chrome with:
yt-dlp --cookies-from-browser chrome:Default --cookies youtube-cookies.txt --skip-download https://www.youtube.com/watch?v=dQw4w9WgXcQ
Then POST the cookie file content to a server endpoint such as:
POST /api/admin/youtube-cookie/update- optional status check:
GET /api/admin/youtube-cookie/status
Use scripts/youtube_cookie_sync.py unless the repo already has its own equivalent.
2. Server download strategy
Use this shape:
- Search top YouTube MV/result for a song.
- Download audio with
yt-dlpinto a per-track cache directory. - Convert the downloaded source into
music.mp3withffmpeg. - Return cached local URLs from the service.
3. MeowMusic source order
Use this order unless the user asks otherwise:
- curated
sources.json - local uploaded/downloaded library
- existing cache hits
- legacy remote music APIs
- YouTube fallback
This keeps the product aligned with the current direction: local-first, old-source-first, YouTube only for missing tracks.
Files in this skill
scripts/install_server_env.sh— server bootstrap for Node 22, yt-dlp, yt-dlp-ejs, ffmpeg.scripts/youtube_cookie_sync.py— export Chrome/Edge/Firefox cookies and push them to the server.scripts/windows/sync_cookie.bat— Windows double-click wrapper.scripts/windows/open_youtube.bat— helper to open YouTube in Chrome.references/cookie-api-and-sync.md— cookie API contract and usage notes.references/server-runtime-notes.md— server environment and challenge-solver notes.references/meowmusic-integration.md— patch strategy and concrete Go snippets.
Execution notes
- Read only the reference file relevant to the current task.
- When editing an existing repo, prefer minimal surgical patches over broad rewrites.
- When a download path already works, preserve behavior and only harden the flaky parts.
- If the target repo differs from MeowMusicServer, reuse the flow, not the exact filenames.
数据来源:ClawHub ↗ · 中文优化:龙虾技能库