volcengine-video

通过自然语言调用火山引擎API生成AI视频或查询视频生成任务状态和结果。

This skill appears to do what it claims: sign requests and call VolcEngine's video APIs. Before installing: (1) Provide the VolcEngine keys only in a dedicated, limited-permission account and store them in the local config.json (or set the VOLCENGINE_* env vars) — do not reuse high-privilege credentials. (2) Be aware the skill will make network calls to https://visual.volcengineapi.com and will send your prompt and API keys as part of authenticated requests. (3) Ensure the runtime environment has Python and the 'requests' package available; no dependency is declared automatically. (4) Note minor inconsistencies: SKILL.md documents config.json keys named access_key/secret_key, but the script also checks environment variables named VOLCENGINE_ACCESS_KEY/VOLCENGINE_SECRET_KEY; README includes a developer-specific absolute path. If these issues worry you, request the publisher to (a) declare required env vars in the metadata, (b) document all credential sources, and (c) add an explicit dependency list or install steps. Finally, only install if you trust the source of these scripts and are comfortable storing API keys locally or as env vars.

Type: OpenClaw Skill Name: volcengine-video Version: 1.0.1 The skill bundle is a legitimate integration for VolcEngine's AI video generation service. The Python scripts (volcengine_video.py and query_task.py) implement standard HMAC-SHA256 V4 request signing to communicate securely with the official VolcEngine API endpoint (visual.volcengineapi.com). No evidence of data exfiltration, unauthorized command execution, or malicious prompt injection was found; the code logic is transparent and aligns with the stated purpose of generating and querying video tasks.