🏷️ The repository no longer carries a DSH topic (none of dsh-plugin / dsh-plugins / dsh). This page is a snapshot from indexing time; the repository is still reachable, but the plugin was removed from listings and maintenance pipelines.

bibigpt-skill

Video summarizer agent skill for Claude Code, Codex, ChatGPT & OpenClaw — YouTube/Bilibili/podcast via BibiGPT CLI/MCP/API (bibi)

Ecosystem appMediaDeveloperTerminalNetworkTerminal / ShellCreator & social

Verification

L5 · Ecosystem app

Risk

Out of scope

Health

Active

Trust

Unrated

Install verification: Ecosystem app: not installed via dsh plugin add, so the L1-L5 plugin install-verification ladder does not apply; the security scan still runs.Install verification details →

What it doesAI

Agent skill that uses BibiGPT CLI to summarize video and audio content for AI coding assistants.

Summarizes videos and audio via BibiGPT
Designed for OpenClaw, Claude Code, Codex
Invokes bibi CLI through agent terminal

mediaAIterminalAI

Capability tags are AI-inferred or rule-extracted from the README (see badge) — vocabulary-limited, not install-verified. AI = inferred; README = literal keyword from the readme.

Installation

GitHub repository

Ecosystem apps are not installable via dsh plugin add: desktop / web shells install or deploy through their own release channel (GitHub Releases or the project site).

The level reads L5 · Ecosystem plugin / L5 · Ecosystem app per the three-way classification (the L1-L5 ladder does not rate them); the security scan still runs.

Verification & Compatibility

Grouped by plugin version: each card lists the dsh versions actually tested against that artifact version and their install verdicts (L5 wins). Untested combinations are omitted — absence means untested, never assumed compatible. L1–L3 are a plugin-level static archive (independent of the dsh version — the same verdict on every dsh row): they sit in each row's level grid next to L4/L5, marked "static", while their evidence is stored once per plugin inside that row's "checks & evidence" instead of being duplicated per version.

External credentials (plugin-level): none detected

Install compatibility (by plugin version, dsh versions within)

Legend:✓ L5 runtime verified○ ecosystem plugin◼ ecosystem app✗ failed

4b2c77github2026-08-24

https://github.com/JimmyLv/bibigpt-skill

Ecosystem app: not installed via dsh plugin add (a desktop / web shell) — its level reads L5 · Ecosystem app.

Author badges

Embed the official badges in your README to showcase security & install-test status:

Security Report

Automated static scan, not manual review.

DSH.SO VETMEDIUM4b2c77

Security reviewAutomated review · daily

MEDIUM

Vet verdict is suspicious: findings need human review (exfiltration endpoints, file deletion, etc.).

0 critical·1 high·0 medium

Version binding

plugin version—

scanned version4b2c77533895git2026-08-25

current versionbbef2e3524b3version moved on

vet verdictsuspicious · git

Vet is an AST static scan (npm artifact or git source).

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Risk details

Risk	Rule	Location	Description
high	R14	bibi-check.sh:21	脚本下载即执行：curl\|sh 远程代码执行（脚本随包分发，安装/运行期任意代码执行面）

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-09-09 · activity: Active

• Repo created: 2026-03-01

• Stars: ★ 127 · Forks: 9

• Health: Active — committed within last 30 days

Source

GitHub: github.com/JimmyLv/bibigpt-skill

Plugin notes

What is bibigpt-skill?

bibigpt-skill is an ecosystem app maintained by @JimmyLv, not a DSH plugin package — it cannot be installed via dsh plugin add; desktop / web shells ship through the project's own release channel. It is cataloged on dsh.so as a Media entry, with a public source repository and automated static security scan.

How do I install bibigpt-skill?

This is an ecosystem app, not a plugin installable via dsh plugin add: desktop / web shells install or deploy through their own release channel. Its level reads L5 · Ecosystem app; the security scan still runs.

How does the security scan relate to a manual audit?

The scan is automated static analysis of the repository source — a scalable first line of defense that can produce false positives and miss context; it is not a manual security audit. Before using a plugin, review the repository and installed permissions, and combine the scan with the verification level (L4/L5) and health signals.

"DeepSeek Harness (dsh) is an open-source agent harness developed by DeepSeek AI. It uses an architecture where everything is a plugin, and is powered by Cordis."
— DeepSeek Harness README

Sources: GitHub repository · DeepSeek Harness README · security scan data · Maintained by dsh.so · Last updated 2026-09-26