Video Sourcing Agent

Run the Video Sourcing Agent with deterministic, concise chat UX for /video_sourcing using a pinned self-bootstrap runtime.

This skill appears to do what it says (fetch and analyze social videos) and needs Google/YouTube API keys, but it bootstraps and executes a pinned GitHub repo on your machine without sandboxing. Before installing or running it: 1) Verify you trust the GitHub repo and inspect the pinned tag (v0.2.3) source that will be cloned. 2) Consider setting VIDEO_SOURCING_AGENT_ROOT to a vetted local copy instead of allowing automatic bootstrap. 3) Limit the API keys' permissions and scope, and avoid using high-privilege keys. 4) Be aware the skill will write into ~/.openclaw/data/... and install dependencies via 'uv sync'. 5) If you cannot inspect the runtime or prefer stronger isolation, do not enable host (unsandboxed) execution or run it in an isolated environment (VM/container). If anything unexpected happens, revoke the API keys and remove the managed runtime directory.

Type: OpenClaw Skill Name: video-sourcing-agent Version: 1.0.0 The skill is classified as suspicious primarily due to significant supply chain risks and potential command injection vulnerabilities, exacerbated by explicit host execution (sandbox mode off). The `scripts/run_video_query.sh` file downloads and executes code from an external GitHub repository (`https://github.com/Memories-ai-labs/video-sourcing-agent.git`) and installs its dependencies via `uv sync`. A compromise of this external repository would lead to arbitrary code execution on the host. Additionally, user input (`<query>`) is passed directly to the `uv run python` command, creating a potential for command or argument injection if not meticulously sanitized by the downstream Python application. The skill also requires access to sensitive `GOOGLE_API_KEY` and `YOUTUBE_API_KEY` environment variables, increasing the impact of a successful exploit.