Vlmrun Cli Skill

Use the VLM Run CLI (`vlmrun`) to interact with Orion visual AI agent. Process images, videos, and documents with natural language. Triggers: image understanding/generation, object detection, OCR, video summarization, document extraction, image generation, visual AI chat, 'generate an image/video', 'analyze this image/video', 'extract text from', 'summarize this video', 'process this PDF'.

This skill appears to be a CLI front-end for a VLM Run / Orion visual-AI service, which normally requires an API key. Before installing or providing secrets: - Verify provenance: there is no homepage or source URL in the registry entry. Try to locate an official project page or PyPI package for 'vlmrun' and confirm the package author. - Expect to supply VLMRUN_API_KEY: SKILL.md requires it, but the registry metadata omitted it — don't paste your API key into an env file or shell until you confirm the package origin. - Check the install commands: SKILL.md uses 'uv' in 'uv venv' and 'uv pip install', which looks like a typo or an unknown helper; replace with standard commands (python -m venv .venv && source .venv/bin/activate; pip install 'vlmrun[cli]') or inspect the package before running. - Prefer installing in an isolated environment (local virtualenv or sandbox) and review the PyPI package files for unexpected behavior before running commands that upload data. If you can provide the skill's source or a link to the 'vlmrun' package, I can re-evaluate with higher confidence.

Type: OpenClaw Skill Name: vlmrun-cli-skill Version: 0.1.1 The skill bundle is classified as suspicious due to the combination of high-risk capabilities, even though they are plausibly needed for its stated purpose. Specifically, the `SKILL.md` instructs the agent to install an external Python package (`vlmrun[cli]`), which introduces a supply chain risk. Furthermore, the `vlmrun` CLI command supports writing output files to arbitrary locations via the `-o` flag, which, while necessary for artifact generation, presents a potential vulnerability for file system manipulation if the agent is subjected to a malicious prompt. The skill also requires a sensitive `VLMRUN_API_KEY` environment variable, increasing the risk surface.