Video Producer

短视频一键生成技能 v2.2。调用video-director进行画面规划，然后生成AI素材、TTS配音、视频渲染，输出完整MP4。

Do not run this skill as-is on a sensitive system. Specific concerns: (1) The code contains hard-coded API keys — treat them as leaked secrets; if you or others have used those keys, rotate them immediately. (2) The skill's metadata does not declare the API keys and helper scripts it actually uses (MINIMAX_API_KEY, MINIMAX_IMAGE_API_KEY and external video-director / minimax-tts scripts). Ask the author to remove hard-coded credentials and declare required env vars and dependencies. (3) The scripts invoke external node/python helpers with execSync and build shell commands from user text — this can allow shell injection if inputs are not sanitized. Avoid passing untrusted text; prefer child_process.spawn with explicit args or a sanitized interface. (4) The skill requires or executes sibling scripts (../../video-director, ../../minimax-tts-cn) — verify those scripts' source before allowing execution because they run with the same agent privileges. (5) produce_fix.js can rewrite produce.js — treat self-modifying behavior cautiously and review its use-case. Recommended actions before installing: run in an isolated sandbox, audit and remove hard-coded keys, require explicit env vars in metadata, review all external endpoints (api.minimaxi.com and any video-director/tts code), and test with non-sensitive sample data. If you cannot verify the external helper scripts and keys, mark the skill untrusted.

Type: OpenClaw Skill Name: video-producer Version: 2.2.1 The skill bundle contains multiple hardcoded API keys for the MiniMax service within `scripts/produce.js` and `scripts/image_gen.js`, which is a major security risk regarding credential exposure. Additionally, `scripts/produce.js` utilizes `execSync` to execute shell commands (ffmpeg, remotion, and python) by concatenating strings with potentially untrusted input, creating a high risk for shell injection. While these are critical vulnerabilities, the code logic remains consistent with the stated purpose of video production, and no clear evidence of intentional data exfiltration or malicious backdoors was found.