Viral Video Studio

Full short-form video content creation workflow for TikTok, Instagram Reels, and YouTube Shorts: analyze a reference viral video URL, reverse-engineer its vi...

This skill appears coherent for building short-form video workflows, but consider the following before installing: (1) It instructs the agent to run yt-dlp and ffmpeg to download and process a TikTok URL and save frames to /tmp — make sure you have permission to download/repurpose that content and check legal/copyright terms for the source and for any platform you publish to. (2) The workflow expects external AI services (DALL·E, Kling AI, Hailuo, etc.); you will need accounts/credentials for those and any uploaded images/character references will be shared with those services. (3) Ensure yt-dlp/ffmpeg/python3 are available on the host; the script assumes those binaries. (4) The skill contains monetization/affiliate guidance — review any affiliate links or claims and be cautious about sharing personal account credentials. If you want a higher-assurance review, provide any additional hidden files or a list of external endpoints the skill will call at runtime (e.g., specific API URLs/SDKs) so I can check for unexpected network exfiltration or requests for unrelated secrets.

Type: OpenClaw Skill Name: viral-video-studio Version: 1.0.0 The skill bundle provides a comprehensive workflow for AI video creation but contains a shell injection vulnerability in `scripts/analyze_tiktok.sh`. The script accepts a user-provided URL and passes it directly to shell commands (yt-dlp) without sanitization, which could allow arbitrary command execution if a malicious URL is provided. While the instructions in `SKILL.md` and the extensive documentation in the `references/` directory are detailed and aligned with the stated purpose of social media strategy, the lack of input validation in the helper script poses a significant security risk.