VideoClaw Pro

视频剪辑脚本执行助手（增强版）- 根据飞书提示词库和直播素材文字档生成剪辑建议脚本。 支持飞书文档（docx）和知识库（wiki）链接，自动解析权限问题。 ⚠️ 重要：本 skill 所有文档读取必须通过 Python CLI 脚本，不使用内置 feishu_doc 工具！ 触发指令格式：「剪辑脚本 [视频类型]...

This skill's functionality (read Feishu doc/wiki, generate clip scripts, write back) is coherent, but there are two red flags you should consider before installing: 1) Hardcoded credentials: videoclaw_lib.py contains APP_ID and APP_SECRET inside the repository. That means the skill will use the author's/owner's Feishu service account to access documents. If you follow the skill's steps (sharing docs with the robot), those documents become accessible to that external account. Only proceed if you trust the skill author and understand that private content will be accessible to their robot. 2) Missing dependency/credential declarations: the metadata lists no required env vars or binaries, but the code needs Python packages (requests, lark_oapi, python-docx) and network access. The skill also forbids using the built-in feishu_doc tool and forces using the included CLI, increasing reliance on the embedded credentials. Recommendations before installation: - Ask the author to remove hardcoded APP_SECRET and instead require the operator to provide credentials via environment variables (declared in requires.env), or to use an OAuth flow that uses the user's own app credentials. - If you cannot get that change, do not share private documents with the robot; instead test with non-sensitive docs. - Verify the APP_ID belongs to a trusted owner (ask for the organization or app registration details) and request an explanation why the built-in feishu_doc tool couldn't be used. - Ensure required Python dependencies are installed in a controlled environment before running the CLI. If the author can provide a version that uses the user’s own credentials (or the platform's built-in feishu_doc tool) and lists dependencies, the concerns would be largely resolved. If the APP_SECRET here is confirmed malicious or unknown and the author refuses to remove it, treat the skill as untrusted.

Type: OpenClaw Skill Name: videoclaw-pro Version: 1.0.0 The skill bundle contains hardcoded Feishu (Lark) API credentials (APP_ID and APP_SECRET) in 'videoclaw_lib.py', which is a significant security risk and potential vector for data access by the credential owner. Additionally, 'SKILL.md' contains instructions that explicitly command the AI agent to bypass built-in OpenClaw tools ('feishu_doc') in favor of a custom Python CLI script using a hardcoded Windows absolute path. While the documentation provides a functional justification for these choices (Wiki link support), the combination of hardcoded secrets and the bypass of standard platform tools is highly irregular.