视频创作

video-creation-pro - 从云端仓库同步的技能

This skill is essentially a pointer to an external GitHub repository and contains only a short checklist. Before installing or allowing it to run: 1) Verify the GitHub repo (owner, commit history, stars/forks, recent activity) and inspect the files under skills/video-creation-pro/ yourself; 2) Do not let the agent automatically execute scripts from that repo without manual review — downloaded code can run arbitrary actions; 3) Ensure no secrets (API keys, cloud credentials) are provided to the skill; 4) If you need to use it, prefer to clone the repo in a sandbox or review the exact install steps and required env vars first; 5) Ask the publisher for a homepage, release tags, or more detailed SKILL.md with concrete, constrained commands and justification for any environment access. Because the SKILL.md is vague, the main risk is whatever is present in the external repository — inspect that before proceeding.

Type: OpenClaw Skill Name: video-creation-suite Version: 1.0.0 The `SKILL.md` file grants `Bash(*)` permissions, allowing the AI agent to execute arbitrary shell commands, which is a significant vulnerability. Additionally, the skill instructs the agent to retrieve "complete skill files" from an external GitHub repository (`https://github.com/anbeime/skill`), posing a potential supply chain risk if the agent were to fetch and execute content from this untrusted source, especially given the broad shell execution capabilities.