← Back to Skills Marketplace
FFmpeg CLI
by
ascendswang
· GitHub ↗
· v1.0.0
6397
Downloads
9
Stars
34
Active Installs
1
Versions
Install in OpenClaw
/install ffmpeg-cli
Description
Process video and audio using FFmpeg CLI for transcoding, cutting, merging, audio extraction, thumbnails, GIFs, speed, filters, subtitles, and watermarks.
Usage Guidance
Install only if you are comfortable running local FFmpeg scripts on files you choose. Use fresh output filenames because the scripts overwrite existing outputs, and avoid passing filenames or file lists from untrusted sources, especially to merge.sh.
Capability Analysis
Type: OpenClaw Skill
Name: ffmpeg-cli
Version: 1.0.0
The `merge.sh` script is vulnerable to command injection. It constructs a temporary file (`TEMP_LIST`) from user-supplied arguments without sanitization and then uses `ffmpeg -f concat -safe 0 -i "$TEMP_LIST"`. The `-safe 0` option disables security checks for the concat demuxer, allowing `ffmpeg` to interpret `file 'pipe:...'` entries in the list as commands. A malicious actor providing crafted input (e.g., `file 'pipe:cat /etc/passwd'`) to the `merge.sh` script could achieve arbitrary command execution or data exfiltration, making this a significant risky capability.
Capability Assessment
Purpose & Capability
The declared purpose is video and audio processing, and the artifacts implement only expected FFmpeg wrapper tasks such as convert, cut, merge, extract audio, thumbnails, GIFs, speed changes, and watermarking.
Instruction Scope
Commands are explicit and user-directed, but scripts accept arbitrary caller-supplied input/output paths and use FFmpeg overwrite mode, so an agent-suggested command should be reviewed before execution.
Install Mechanism
SKILL.md discloses FFmpeg as a Homebrew-installable dependency; speed.sh also uses bc, which is a minor undeclared local dependency. No hidden installer or remote code download is present.
Credentials
Local media file reads and writes are proportionate for an FFmpeg skill. merge.sh uses concat with -safe 0 and an unescaped temporary file list, which is common for broad path support but unsafe with untrusted or maliciously crafted filenames.
Persistence & Privilege
The artifacts show no persistence, background execution, privilege escalation, credential access, network exfiltration, or account authority.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install ffmpeg-cli - After installation, invoke the skill by name or use
/ffmpeg-cli - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release: comprehensive video/audio processing with cut, merge, extract-audio, thumb, gif, convert, speed, watermark scripts
Metadata
Frequently Asked Questions
What is FFmpeg CLI?
Process video and audio using FFmpeg CLI for transcoding, cutting, merging, audio extraction, thumbnails, GIFs, speed, filters, subtitles, and watermarks. It is an AI Agent Skill for Claude Code / OpenClaw, with 6397 downloads so far.
How do I install FFmpeg CLI?
Run "/install ffmpeg-cli" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is FFmpeg CLI free?
Yes, FFmpeg CLI is completely free (open-source). You can download, install and use it at no cost.
Which platforms does FFmpeg CLI support?
FFmpeg CLI is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created FFmpeg CLI?
It is built and maintained by ascendswang (@ascendswang); the current version is v1.0.0.
More Skills