Morfeo UGC Engine

Genera y gestiona videos UGC para marcas argentinas con pipeline completo, desde guión hasta publicación en redes, con control manual y logs.

This skill is plausible for controlling a local UGC engine but exercise caution: 1) Confirm you actually run a Morfeo Engine at http://localhost:3336 before installing; 2) Do not rely on the hardcoded token in the SKILL.md — treat it as a placeholder and configure a least-privilege token via an environment variable (and ask the maintainer to declare MORFEO_API_TOKEN in metadata); 3) Understand that the skill's instructions include commands that read project files and restart services (pm2) — only grant such control in a trusted, isolated environment; 4) Ask the publisher for the source repo or homepage and verify the maintainer identity before use (README references a GitHub repo but the skill package lacks source); 5) If you intend to expose this to a multi-user or production system, audit the local API for what the admin token can do (privilege escalation, deletion, publishing) and rotate/change tokens as needed.

Type: OpenClaw Skill Name: morfeo-ugc-engine Version: 1.0.0 The skill bundle provides instructions for an AI agent to manage a local video generation pipeline using shell commands (curl, pm2, ls) and a local API. It contains hardcoded administrative credentials ('morfeo-admin-2026') and lacks input sanitization in the shell command templates within SKILL.md, which could be exploited for command injection. While the capabilities are aligned with the stated purpose of the 'Morfeo UGC Engine,' the reliance on shell execution and hardcoded secrets represents a significant security risk.