Video Editing Agent (VEA)

Video Editing Agent (VEA) for automated video processing, highlight generation, and editing. Use when asked to index videos, create highlight reels, generate...

This skill appears to be a legitimate video-editing service but contains several red flags you should address before installing: (1) The registry only lists MEMORIES_API_KEY, yet the code and docs require Google, ElevenLabs, and Soundstripe API keys plus possible GCP auth—verify whether you need to supply all of them. (2) The install instructions include running a remote install script (curl | sh); avoid blindly running it—review the script or install dependencies via trusted package managers. (3) The service uploads frames/text to external providers (Memories.ai, ElevenLabs, Soundstripe); confirm you are comfortable sharing video content and transcripts with these services and check their privacy/TOS. (4) Inspect the GitHub repo/source (pin a commit or release) and review src/app.py (not included here) for unexpected network calls or secrets exfiltration. (5) Run the skill in an isolated environment (VM/container) and keep API keys limited (scoped, revocable). If you need help auditing specific files (e.g., src/app.py) or verifying the remote installer script, provide them and I can analyze further.

Type: OpenClaw Skill Name: vea Version: 1.1.2 The skill is classified as suspicious primarily due to the use of `curl -LsSf https://astral.sh/uv/install.sh | sh` in `SKILL.md` for installing the `uv` package manager. While a common installation method for legitimate tools, this practice executes arbitrary remote code, posing a significant supply chain risk if the remote server were compromised. Additionally, `SKILL.md` instructs the agent to perform `gcloud auth application-default login`, granting sensitive access to Google Cloud resources, and API keys are stored locally and loaded into environment variables, which is a standard but vulnerable practice. There is no evidence of intentional malicious behavior like data exfiltration to unauthorized endpoints or stealthy backdoors.