基于飞书平台，支持视频下载、语音识别、静音检测、智能裁剪、字幕生成及自动上传功能的视频编辑工具。

What to consider before installing or running this skill: - Feishu integration mismatch: The documentation promises downloading from and uploading to Feishu cloud, but the code does not show any Feishu API usage or request Feishu credentials. Expect that upload/download to Feishu will not work out-of-the-box. Ask the author for how Feishu auth should be provided (e.g., APP_ID/APP_SECRET or access token) and request a code path that uses those credentials. - Local execution & data exposure: The skill downloads/reads video files locally and writes temporary files (e.g., /tmp/*.json, temp audio/video clips). If you run this on sensitive videos, they will be processed locally and may be stored temporarily — run in an isolated environment if needed. - Model and network usage: Installing requirements installs openai-whisper and friends; loading Whisper will likely download model weights from the network and consume a lot of disk and bandwidth. Plan for this and run inside a controlled environment. - Shell injection risk: src/index.ts builds and execs a shell command by concatenating unescaped arguments. If a video path or other argument can be influenced by an untrusted user, this could allow command injection. Before using, patch runPythonScript to use execFile/spawn with an argument array (no shell interpolation) or properly sanitize/escape inputs. - Code completeness: The Python file posted is truncated but mostly does local processing. Review the full video_processor.py for any network calls, hidden endpoints, or unexpected behavior. Confirm there is no hard-coded upload endpoint or credentials in other parts of the repository. - Mitigations if you want to use it: run inside a dedicated unprivileged VM/container; review and fix the exec invocation to avoid shell interpolation; require and document Feishu credentials and implement/verify Feishu upload/download flows; run pip installs inside a virtualenv; test with non-sensitive sample videos first. Given the inconsistencies and the command-execution risk, treat this skill as suspicious until the Feishu integration and safe execution model are clarified and the shell-invocation issue is corrected.

Type: OpenClaw Skill Name: feishu-video-editor Version: 1.0.0 The skill contains a significant shell injection vulnerability in `src/index.ts` within the `runPythonScript` function, where user-provided arguments (such as file paths and timestamps) are concatenated into a shell command string and executed via `child_process.exec` without sanitization. While the Python backend (`src/video_processor.py`) uses safer `subprocess.run` list-based calls for FFmpeg, the TypeScript entry point's use of a raw shell string allows for arbitrary command execution. The functionality itself (video editing via FFmpeg and Whisper) appears legitimate and aligned with the documentation, but the lack of input validation makes it highly vulnerable.