Tencent VOD Intl.

Tencent Cloud VOD (Video on Demand) command generation assistant. Must trigger whenever the user's request involves any VOD operation: [Upload] local/URL pul...

Before installing or enabling this skill: - Understand credentials: The scripts require TENCENTCLOUD_SECRET_ID and TENCENTCLOUD_SECRET_KEY (and optionally a VOD AIGC token). The registry metadata omits these required env vars — treat that as an inconsistency and verify credential needs manually. - Review vod_load_env.py: This helper scans /etc and shell startup files and will load all KEY=VALUE pairs from any file that contains a target key. That means other secrets or environment variables in those files could be loaded into the script process. If you do not want the skill to scan your shell/system files, remove or modify vod_load_env.py or avoid importing it. - Principle of least privilege: Provide Tencent credentials via a dedicated, minimal-scope account and avoid storing other service keys in the same files scanned by the skill. Prefer setting required env vars explicitly for the runtime environment (CI/secrets manager) rather than relying on automatic file-loading. - Cost and billing: Processing/AIGC/transcoding calls incur charges. SKILL.md enforces showing a cost notice for processing scripts — double-check any generated command before running to avoid duplicate or unexpected billable tasks. - Run in isolation if possible: Test the scripts in a disposable environment or container so that accidental exposure of local config is limited. - If you need to trust this skill long-term: ask the publisher to fix the registry metadata to declare required env vars, and consider removing/limiting the env-file scanning behavior or making it opt-in (explicit flag) so the skill only uses credentials you explicitly provide.

Type: OpenClaw Skill Name: tencent-vod-intl Version: 1.0.6 The skill bundle contains scripts (vod_load_env.py and vod_aigc_token.py) that perform broad read and write operations on sensitive system and user configuration files, including /etc/environment, ~/.bashrc, and ~/.profile. While these are intended for managing Tencent Cloud credentials and AIGC tokens, the ability to modify shell profiles represents a significant security risk and potential persistence vector. The rest of the bundle appears to be a legitimate integration with Tencent Cloud VOD services.