Bole Story Creator is a skill that calls Bole AI platform to generate short drama stories, including story creation, storyboard generation, and video product...

This skill appears to implement the described Bole AI story/video workflow, but take these precautions before installing or running it: - Confirm origin: the package registry metadata and _meta.json disagree on owner/slug — verify the source and author (ask the publisher or fetch from their official repo). - Provide only a scoped BOLE_ACCESS_KEY and avoid using a high-privilege account. Be prepared to rotate the key after testing. - The script prints the access token and other internal IDs to stderr; if you install/run this within an agent or CI that collects logs, the token may be exposed. Consider editing the script to remove or redact prints of tokens and secrets before use. - Review the hardcoded ClientID header and request details from the publisher (why is ClientID fixed, is it required?). - Run the script in an isolated/sandboxed environment first and monitor network traffic to confirm requests go only to bole.bonanai.com. - If you need to proceed with the skill, ask the author to fix metadata (declare required env var in registry metadata), stop printing tokens, and provide provenance for _meta.json owner/slug mismatch. If you cannot verify the author/source or cannot mitigate the token-logging issue, treat this skill as risky and avoid installing it in sensitive environments.

Type: OpenClaw Skill Name: bole-story-creator Version: 1.0.0 The skill interacts with the Bole AI platform to generate videos, but it contains security and privacy vulnerabilities in 'scripts/main.py'. Specifically, it logs the session 'access_token' to 'stderr', which can lead to credential exposure in log files. Additionally, it uses a hardcoded 'project_id' (2033716579396616193), which likely results in all users' generated content being stored within the same project workspace, potentially allowing the project owner or other users to access private data.