The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to clone and install code from a third-party repository (https://github.com/zbjincheng/openclaw-skill-videotranslate.git), which introduces unverified code into the local environment.
[REMOTE_CODE_EXECUTION]: The installation process involves downloading a remote repository and executing it via pip install, creating a vector for remote code execution from an untrusted source.
[PRIVILEGE_ESCALATION]: The setup instructions recommend executing sudo apt install ffmpeg, which requires administrative privileges on the host system.
[COMMAND_EXECUTION]: The skill performs video and audio processing by executing shell commands through the FFmpeg utility.
[DATA_EXFILTRATION]: Subtitle text and audio data are transmitted to external service providers (e.g., OpenAI or custom API endpoints) for translation and Text-to-Speech synthesis.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted subtitle data from external files (.srt, .vtt) and processes this content using LLM-based translation providers.
Ingestion points: Subtitle paths provided by the user or extracted from source videos as seen in SKILL.md.
Boundary markers: The skill does not implement delimiters or safety instructions to prevent the LLM from obeying commands embedded within the subtitle text.
Capability inventory: The skill possesses the ability to execute subprocesses (FFmpeg) and perform outbound network requests to various API endpoints.
Sanitization: There is no evidence of input validation or sanitization of the subtitle content before it is processed by the translation engine.

openclaw-videotranslate-skill