TikTok Viral Slideshow Automation

Automates creation and uploading of educational TikTok slideshows with AI-generated images and tracks performance via AutomateClips API.

Do not proceed blindly. Key points to consider before installing/using this skill: - The SKILL.md requires sensitive API keys (AutomateClips and an image-provider key), but the published metadata omits these; ask the publisher why credentials were not declared. - Never paste secret keys into a chat; set and export them in your own shell only if you trust and have reviewed the code that will use them. - The skill instructs you to create and run a python script (nano_banana-2.py). Request the full script content and review it line-by-line (or have a developer review it) before running it or pip-installing dependencies. - Use test accounts and short-lived API keys where possible. Rotate keys after testing and limit the AutomateClips/TikTok account privileges. - Because this is instruction-only, static scanners could not analyze code; ask the publisher for the complete scripts and any network endpoints the scripts call so you can validate them. - If you proceed, prefer running everything in an isolated environment (container or VM) and avoid using production credentials until you are sure of the code's behavior.

Type: OpenClaw Skill Name: tiktok-viral-slideshow-automation Version: 1.0.1 The skill automates TikTok slideshow creation by integrating multiple AI image generation APIs (Replicate, OpenAI, Google) and the AutomateClips service. It is classified as suspicious because it requires the collection and storage of multiple sensitive API tokens in environment variables and executes shell commands (curl) that are vulnerable to shell injection if user-provided strings like 'SLIDESHOW TITLE' are not properly sanitized. Additionally, it references an unverified model identifier ('google/nano-banana-2') and suggests setting up recurring automation via a scheduling skill, which increases the potential impact of any exploited vulnerability.