Visla AI Video Creation

Creates AI-generated videos from text scripts, URLs, or PPT/PDF documents using Visla. Use when the user asks to generate a video, turn a webpage into a vide...

This skill appears to do what it says: it runs local CLI wrappers that call Visla's API and upload user-supplied files. Before using it: (1) Only provide your Visla API key/secret if you trust the Visla service and this skill's source; (2) Grant explicit permission if the agent asks to read ~/.config/visla/.credentials — otherwise supply credentials yourself via environment variables or the CLI flag; (3) Be aware that providing a URL causes the agent to make outbound HTTP requests to validate and fetch that page, and uploading documents will use pre-signed S3 URLs returned by Visla; (4) If you don't trust the skill author, review the bundled scripts (they are included) or run them in a restricted environment. Overall there are no red flags, but treat API keys and uploaded documents as sensitive and only share when comfortable.

Type: OpenClaw Skill Name: visla Version: 1.0.3 The skill is classified as suspicious due to significant Local File Inclusion (LFI) vulnerabilities in both `scripts/visla_cli.sh` and `scripts/visla_cli.py`. Both scripts allow reading and uploading arbitrary local files (e.g., via `script @filename` or `doc filename` commands) if the agent is prompted to provide a sensitive file path. Additionally, the Python script explicitly supports reading credentials from an arbitrary file path via `--credentials-file`. The `SKILL.md` also presents a prompt injection surface, as it instructs the AI agent to ask for user consent before accessing local credential files, which could be bypassed by a malicious prompt. These issues represent critical vulnerabilities that could lead to unauthorized data exposure, though there is no clear evidence of intentional malicious behavior within the code itself.