Openclaw Skill Cutmv Video Tool

A video processing tool using FFmpeg to cut, convert, compress videos, extract frames/audio, add text watermarks and subtitles for messaging apps.

This skill appears to be what it claims (ffmpeg-based video tools) and has no unrelated credential or network requests, but take these precautions before use: - Review or patch the code: replace eval(video_stream.get('r_frame_rate', '0/1')) with a safe parser that splits the string on '/' and computes numerator/denominator (or use fractions.Fraction). Using eval on external data is unsafe. - Run the skill only in a restricted environment (sandbox, container, VM) when processing untrusted media files—ffmpeg and ffprobe have had security vulnerabilities and malformed media can trigger them. - Keep ffmpeg/ffprobe up to date from official releases. - If you want extra assurance, ask the author for a short explanation of why eval was used and for a patched version; or run a quick code review/tests that exercise get_video_info with crafted inputs. If you will only process trusted local files and can mitigate the eval issue, the skill is reasonable to use. If you process arbitrary uploads or untrusted files, treat it as risky until the eval usage is removed and you sandbox ffmpeg calls.

Type: OpenClaw Skill Name: openclaw-skill-cutmv-video-tool Version: 0.1.0 The skill is designed for legitimate video processing using FFmpeg. However, it contains significant vulnerabilities. The `skill.py` file uses `eval()` on `ffprobe` output in the `get_video_info` function, which is a critical RCE vulnerability if an attacker can craft a malicious video file to control `ffprobe`'s output. Additionally, the `add_subtitle` function directly interpolates the user-provided `style` parameter into an FFmpeg filter string, allowing for potential FFmpeg filter injection. While there is no evidence of intentional malicious behavior, these vulnerabilities could be exploited for harmful actions.