unisk_video_notification_pro

向指定手机号码发送IVVR视频通知，需要传入视频本地路径和手机号

Before installing, verify and correct the manifest inconsistency: the registry metadata should list the four required env vars. Only use this skill with a trusted IVVR BASE_URL and with credentials scoped narrowly to that service. Prefer enabling TLS verification (remove verify=False) so uploads and API calls verify server certificates. Restrict the allowed video_path inputs (e.g., accept files only from a dedicated media directory) to prevent accidental or malicious upload of sensitive files. Store ACCESS_SECRET and other credentials securely (do not reuse broad AWS/SSH/etc. secrets). If you allow autonomous invocation for this skill, be aware it can read and upload arbitrary local files; consider disabling autonomous invocation or adding path-validation safeguards if you cannot fully trust the agent or the remote service.

Type: OpenClaw Skill Name: video-notification-pro Version: 1.0.1 The skill exhibits risky behavior by disabling SSL certificate verification (`verify=False`) in multiple `requests.post` calls within `SKILL.md`, which exposes sensitive API credentials and data to man-in-the-middle attacks. Furthermore, the tool allows the agent to read and upload any local file (up to 5MB) to a remote endpoint defined by the `BASE_URL` environment variable; without path restricted to a specific directory, this could be exploited for data exfiltration of sensitive system files if the agent is manipulated via prompt injection.