Video App

Automation skill for VibeClip - AI Music Video Gen.

This skill appears to do what it claims (generate short music videos using a local Ollama model + FFmpeg). Before installing or running it: 1) Ensure you have node, Ollama, and FFmpeg installed and trust the local Ollama models you pull. 2) Run 'npm install' in the skill directory so dependencies are installed (SKILL.md doesn't list this step). 3) If you deploy to a VPS, protect the service (authentication, HTTPS, firewall, rate limits) because the app accepts unauthenticated uploads and serves outputs publicly. 4) The SKILL.md mentions payments/ETH but there is no payment code — treat that as marketing only. 5) Consider disk-quota and cleanup policies (uploads/ and outputs/ are written to disk). If you need the skill to handle sensitive inputs or be internet-facing, add access controls and monitoring first.

Type: OpenClaw Skill Name: vibeclip Version: 1.2.0 The skill is classified as suspicious due to a prompt injection vulnerability against the local Ollama LLM in `index.js`. The user-provided `prompt` is directly interpolated into the `ollama.chat` message, allowing an attacker to manipulate the LLM's output and potentially generate unintended or harmful content. While the use of `child_process.spawn` for FFmpeg is implemented securely with an array of arguments, mitigating direct shell injection, the LLM prompt injection represents a significant vulnerability in the AI interaction, even if it does not directly lead to host compromise or data exfiltration.