📺 Bili Summary — 哔哩AI摘要
v1.0.0一键下载B站视频，提取字幕并调用Gemini 2.5 Flash生成精准长文摘要，高效提炼视频要点。
0· 688·3 当前·3 累计
by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
What to check before installing/using this skill:
- Confirm you are comfortable supplying a GEMINI_API_KEY: the runtime requires GEMINI_API_KEY (used to call Generative Language API). The registry metadata did NOT declare this requirement — expect to set it manually.
- Expect network activity and file writes: the script downloads video/audio, may download Whisper model weights (faster-whisper will fetch models), and writes output under your home workspace (~/.openclaw/workspace/coding-agent/tem...详细分析 ▾
ℹ 用途与能力
The skill's code and SKILL.md align with the described purpose: it uses yt-dlp to download Bilibili content, faster-whisper for transcription, and the Gemini generativelanguage API for summaries. That capability set is coherent for a 'Bili Summary' tool. However, the skill metadata published in the registry declares no required env vars or install spec while the SKILL.md and script clearly require yt-dlp, Python packages (yt-dlp, faster-whisper), and a GEMINI_API_KEY — this metadata mismatch is unexpected.
⚠ 指令范围
The SKILL.md instructs the agent to read GEMINI_API_KEY from the environment and to install/run yt-dlp and faster-whisper; the included script reads the same env var and performs network calls to Bilibili and Google. The instructions and code stay within the stated purpose, but they reference an environment secret (GEMINI_API_KEY) that is not declared in the registry metadata. The SKILL.md also contains contradictory statements about whether audio/subtitle files are auto-deleted and shows a different workspace path than the script (~/openclaw vs ~/.openclaw), which increases risk of accidental data retention or confusion.
ℹ 安装机制
There is no formal install spec in the registry (instruction-only in practice). SKILL.md recommends pip installing yt-dlp and faster-whisper — these are well-known packages (moderate trust). The faster-whisper/Whisper model usage implies automatic model weight downloads (e.g., from Hugging Face) and significant disk/network activity; this is expected for transcription but should be documented. No arbitrary or obfuscated remote code sources are used in the included script.
⚠ 凭证需求
The only runtime secret the implementation requires is GEMINI_API_KEY, which is appropriate for calling the Gemini API. However, the registry metadata does not declare this required env var (declares none), creating an inconsistency. The script places the API key on the request URL as ?key=..., which can leak the key in logs or browser history if not handled carefully. No other unrelated credentials are requested.
✓ 持久化与权限
The skill does not request always:true or other privileged persistence. It writes temporary files into a workspace directory under the user's home and does not alter other skills or system-wide settings. The script may retain audio/subtitle files by default (the documentation is contradictory), so files can persist on disk until manually removed.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/26
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install bili-summary
镜像加速npx clawhub@latest install bili-summary --registry https://cn.longxiaskill.com