SVG Animator

Generate animated videos from SVG frames using text LLM. Supports any subject (animals, humans, characters, scenes, abstract art), automatic duration calcula...

This skill is mostly coherent for generating SVG frames and assembling them into videos using local tools (ffmpeg and rsvg-convert). Before installing or running it: 1) Understand it runs local shell commands and writes files (default /tmp) — test in an isolated/sandbox environment. 2) Ensure ffmpeg and rsvg-convert are installed from your OS package manager. 3) Inspect scripts/animate.js for any execSync calls that include unsanitized user-supplied strings (output paths, --theme, --story). If you allow untrusted input, escape or validate it to avoid command injection. 4) The description mentions using a text LLM to generate SVG; the code does not contact any LLM API or require API keys — this is likely because the agent/LLM is expected to produce SVG text. If you need a networked LLM integration, confirm how credentials would be provided. 5) Avoid running this as root and avoid auto-copying outputs into webserver directories without checking file ownership/permissions. If you want higher assurance, run the script in a container or review the full, untruncated animate.js to confirm there are no unexpected execSync invocations or hidden network calls.

Type: OpenClaw Skill Name: svg-animator Version: 1.0.0 The skill provides a utility for generating SVG-based animations but contains a shell injection vulnerability in `scripts/animate.js`. The `--output` command-line argument is used directly within an `execSync` call to `ffmpeg` without sanitization, which could allow for arbitrary command execution if a malicious path is provided. While the code logic aligns with the stated purpose and no evidence of intentional malice or data exfiltration was found, the lack of input validation on shell-executed commands poses a security risk.