Cinematic Script Writer

Create professional cinematic scripts for AI video generation with character consistency and cinematography knowledge. Use when the user wants to write a cinematic script, create story contexts with characters, generate image prompts for AI video tools (Midjourney, Sora, Veo), or needs cinematography guidance (camera angles, lighting, color grading). Also use for character consistency sheets, voice profiles, anachronism detection, and saving scripts to Google Drive.

This skill appears to do what it claims (script generation, cinematography guides, prompt building) and installs via npm, but before installing: 1) Verify the npm package author and version on the npm registry (openclaw-skills) and inspect the package contents or source repo to ensure they match what you see here. 2) Open the storage-adapter.ts and storage-manager.ts files to confirm how Google OAuth tokens are handled (look for any code that writes tokens to a remote endpoint or to disk). 3) Confirm whether googleapis (or another Drive client) is listed as a dependency in the skill-specific package.json—if Drive integration is expected but the dependency is missing, that could be an oversight or indicate a mismatch. 4) Be aware the skill can write to your local Downloads folder when using local storage—if you need to limit filesystem access, run it in a sandbox/container. 5) If you plan to use the Google Drive integration, only proceed with the interactive OAuth flow and verify the consent screen and scope requested; do not paste service account keys or secrets into the CLI. 6) If you are unsure, test the package in an isolated environment (container or VM) first and inspect runtime network traffic and file writes.

Type: OpenClaw Skill Name: openclawskills Version: 1.4.0 The skill bundle is classified as suspicious primarily due to a Remote Code Execution (RCE) vulnerability present in the `skill-template/index.ts` file, which uses `Function("...return (" + expression + ")")()` to evaluate user-provided input. Although this is in a template and not directly part of the main `cinematic-script-writer` skill's active code, its inclusion in the bundle highlights a risky pattern. Additionally, the `SKILL.md` (top-level) and `skills/cinematic-script-writer/SKILL.md` files contain JavaScript code blocks intended as human CLI usage examples, which pose a prompt injection risk against the AI agent if the agent's execution environment misinterprets these documentation blocks as executable commands. The skill also requests broad permissions like `http:request` (for LLM and Google Drive APIs) and the `examples/file-manager-skill/index.ts` demonstrates powerful `fs:read/write/delete` capabilities, which, while justified by their stated purpose, contribute to the overall risk profile.