Sora Video Generation

Generate videos from text prompts or reference images using OpenAI Sora. ✅ USE WHEN: - Need AI-generated video from text description - Want image-to-video (animate a still image) - Creating cinematic/artistic video content - Need motion/animation without lip-sync ❌ DON'T USE WHEN: - Need lip-sync (person speaking) → use veed-ugc or ugc-manual - Just need image generation → use nano-banana-pro or morpheus - Editing existing videos → use Remotion - Need UGC-style talking head → use veed-ugc INPUT: Text prompt + optional reference image OUTPUT: MP4 video (various resolutions/durations)

This skill is functionally coherent with its description (it calls OpenAI Sora to generate videos), but take these precautions before installing or running it: - Provide only a scoped OpenAI API key and be aware this key will be used to create video jobs and download content; verify billing and key permissions. The skill uses OPENAI_API_KEY (or --api-key) but the registry metadata omitted this — expect to supply it yourself. - Install the required Python environment and libraries (Python >=3.10, openai, httpx, pillow) or run in a controlled environment (virtualenv/venv) to avoid affecting system packages. - The code saves temp image files and the final MP4 to disk; ensure you run it in a directory where writing files is acceptable. - Videos may expire on the provider side (~1 hour), so they are downloaded immediately by the script; be mindful of any sensitive content sent to the API. - The skill source and homepage are unknown — if you need higher assurance, ask the publisher for provenance (where the package came from, signed releases, or an official repo) before trusting it with an API key. If you want to proceed, consider creating a dedicated OpenAI API key with limited scope or billing limits to reduce risk.

Type: OpenClaw Skill Name: sora Version: 1.0.1 The skill bundle is suspicious due to critical vulnerabilities in `scripts/generate_video.py`. The script allows arbitrary file write via the `--filename` argument and arbitrary file read via the `--input-image` argument, as it directly uses user-provided paths without sufficient sanitization or restriction. These flaws could be exploited by a malicious user interacting with the OpenClaw agent to overwrite or read sensitive files on the system where the agent is running. There is no evidence of intentional malicious behavior such as data exfiltration to unauthorized third parties or backdoor installation.