one-number-explains-video-gen

Create vertical data-stat hooks: hero number, ramping counter or graph, closing meaning line, timed English captions (WeryAI). Use for dataviz Shorts, macro...

This skill appears to do what it says: it runs a Node CLI that calls WeryAI endpoints and requires only WERYAI_API_KEY. Before use: (1) review scripts/video_gen.js if you plan to supply local image paths — the script will read local files and POST them to api-growth-agent.weryai.com using your WERYAI_API_KEY to obtain a public URL; only allow that if you explicitly consent to uploading those files. (2) Prefer supplying public https:// image URLs to avoid local uploads. (3) Treat WERYAI_API_KEY as a secret (use a short-lived or scoped key if possible), and run generation in an isolated environment if you are concerned about data exposure. (4) If you need stronger assurance, inspect the remainder of the shipped script (the main entrypoint) to confirm it only reads WERYAI_API_KEY and the documented hosts.

Type: OpenClaw Skill Name: one-number-explains-video-gen Version: 1.0.0 The skill provides a video generation tool that includes a Node.js script (scripts/video_gen.js) capable of reading arbitrary local files and uploading them to a remote API (api-growth-agent.weryai.com). While this functionality is intended for uploading images and is documented in SKILL.md with instructions for the agent to seek user consent, the script lacks path validation or strict file-type enforcement. This creates a 'confused deputy' risk where a prompt injection could trick the agent into exfiltrating sensitive local files (e.g., SSH keys or environment secrets) by passing their paths to the upload function.