Vlog Auto Edit

AI Agent自动剪辑旅行Vlog的完整工作流。从原始素材到成品视频，系统级只需ffmpeg，其余在Python venv内完成。

This skill is largely coherent for automated vlog editing, but take the following precautions before installing or running it: - Credentials and endpoints: the workflow sends extracted frames to a vision API (API_URL/API_KEY). Only provide keys for vision providers you trust and that have an acceptable privacy policy. Do not hand over credentials to unknown endpoints. - Test with non-sensitive data: first run the skill on throwaway/sample clips (no personal or private content) to observe network calls and outputs. - Prefer isolated environments: use a Python venv or container rather than installing packages globally (the SKILL.md suggests both; follow the venv option to reduce system impact). - Inspect files for hidden content: the SKILL.md triggered a unicode-control-chars detection—open it in a hex/inspector or a trusted editor to ensure there are no hidden control characters or surprising instructions. - Review network activity: if possible, run the agent in an environment where you can monitor outbound requests (so you can see where frames are uploaded). - Review the upstream repo and author: the README points to a GitHub repo; verify the source code there and check commit history/issues. If you cannot verify the origin, be more cautious. If you want, I can: (1) extract and show any non-printing/control characters found in SKILL.md, (2) list the exact places where the instructions send data off-host, or (3) suggest a minimal, offline configuration (use only local models) to avoid uploads.

Type: OpenClaw Skill Name: vlog-auto-edit Version: 1.0.1 The skill bundle provides a legitimate workflow for automated video editing but utilizes high-risk capabilities, including automated package installation (pip install) and extensive shell command execution via ffmpeg. Specifically, code examples in SKILL.md utilize subprocess.run(shell=True), which presents a shell injection vulnerability. While these actions are aligned with the stated purpose of video processing, the instructions require classifying risky capabilities (shell/file access) as suspicious even when they are plausibly needed for the task.