Melies

AI filmmaking CLI with 148 built-in actors, 98 visual styles, and smart model selection. Generate images, videos, posters, and thumbnails without prompt engi...

This skill appears to do what it says: a CLI that talks to melies.co. Before installing, confirm you trust the melies npm package and the melies.co domain. Be aware the CLI saves your API token to ~/.melies/config.json and will open a browser and run a short-lived localhost server during the login flow — both are standard but mean the token is stored locally. Only provide a token with the minimum needed permissions and do not set MELIES_API_URL to an untrusted host (changing it could redirect your token/requests). If you need stronger assurance, review the package source on the upstream repo and install from a verified registry account.

Type: OpenClaw Skill Name: melies Version: 2.1.0 The Melies CLI skill bundle is classified as suspicious due to significant security vulnerabilities that could be exploited via prompt injection. Specifically, the login command in src/commands/login.ts (and the compiled dist/index.js) is vulnerable to shell injection because it incorporates the MELIES_API_URL environment variable into a child_process.exec call without sanitization. Additionally, multiple commands including image, video, and pipeline (src/commands/image.ts, src/commands/video.ts, src/commands/pipeline.ts) allow arbitrary file writes via the --output flag without path validation, potentially enabling the overwriting of sensitive system files. While these appear to be unintentional vulnerabilities rather than intentional malware, they pose a high risk in an autonomous agent environment.