视频批量处理技能包 - 一键处理100个视频，自动剪辑、加字幕、配乐、调风格。适合自媒体从业者、短视频创作者。

This package appears to be a local batch video editor and includes the Node scripts you would expect. Before installing or running: 1) Note the manifest omission — you must install Node.js (>=18) and FFmpeg separately; SKILL.md and package.json expect them. 2) Inspect the included scripts yourself (already present) — they spawn shell ffmpeg/ffprobe commands. Because commands are constructed from file paths and run via the shell, malformed or malicious filenames could cause command injection; avoid running on untrusted files or use an isolated VM/container. 3) Ensure the ffmpeg/ffprobe binaries on your PATH are from a trusted source (download official builds) to avoid running trojaned binaries. 4) If you plan to run this in production, consider sanitizing filenames and running in a restricted environment, and test with sample data first. If you want higher assurance, ask the author for a signed release or a repository with commit history and an explicit list of runtime requirements.

Type: OpenClaw Skill Name: autoclip-pro Version: 1.0.1 The `scripts/video-editor.js` file is highly vulnerable to shell injection. It uses `child_process.execSync` and `child_process.spawn` with `shell: true` to execute FFmpeg and FFprobe commands. User-controlled inputs, such as video filenames (from `fs.readdirSync` in `scripts/batch-process.js`) and configuration values like `watermark.text` (from `config.json`), are embedded directly into these shell commands without robust sanitization or escaping. This allows for critical Remote Code Execution (RCE) if a malicious filename (e.g., `video.mp4" -exec evil_command #`) or a crafted `watermark.text` value (e.g., `'; rm -rf / #'`) is processed. While this is a severe vulnerability, there is no evidence of intentional malicious behavior like data exfiltration or backdoor installation, hence it is classified as suspicious.