Videogen

视频号AI短视频自动化生产流水线（v2）。用户说"做视频"、"生成视频"、"短视频制作"、"视频混剪"时触发。支持三种内容模式自动切换（Mode A纯干货 / Mode B剧情+科普 / Mode C漫剧型）。使用 MiniMax Hailuo AI 生成视频片段，配合 FFmpeg 混剪，输出适合视频号发布的完...

This package appears to implement the described video pipeline, but the metadata omits key runtime requirements. Before running or installing: 1) Inspect scripts (scripts/v2/*.py, skills/*) for unexpected network calls or file reads. 2) Expect to need Python, pip packages, Node/Remotion, and FFmpeg — the skill does not declare them. 3) The pipeline calls remote AI services (MiniMax Hailuo, IMA, Whisper) and references API keys — only provide credentials you trust and use scoped keys. 4) Because package-lock uses non-default mirrors and many dependencies exist, prefer running in an isolated VM/container or sandbox and limit network egress. 5) If you only want content generation (no local execution), request a vetted hosted service or ask the author to declare required env vars and provide a minimal reproducible install guide. If you want, I can list the exact files/lines that reference network endpoints, credentials, or that perform filesystem writes so you can review them more quickly.

Type: OpenClaw Skill Name: videogen Version: 2.2.0 The skill bundle provides a highly complex and functional AI video generation pipeline. It is classified as suspicious due to several significant security vulnerabilities: 'scripts/build_composite.sh' and 'scripts/v2/run_remotion_render.py' construct shell commands (FFmpeg and npm) using potentially unsanitized user input, creating a risk for shell injection. Additionally, 'scripts/v2/url_extractor.py' allows for arbitrary web scraping which could be leveraged for SSRF (Server-Side Request Forgery), and several scripts automatically invoke 'pip install' or 'npm install' for missing dependencies, which is a risky behavior in agentic environments. While these appear to be design choices for ease of use rather than intentional malice, they represent a significant attack surface.