CLI audio mastering without a reference track using ffmpeg; accepts audio or video inputs and outputs mastered WAV/MP3 or remuxed MP4.

Do not run the provided PowerShell command until you have the actual script and have inspected it. The SKILL.md expects a file scripts/master_media.ps1 that is not included in this package; acquiring that script from an external repo (or running it directly) could execute arbitrary commands. Steps to take before installing or running: 1) Obtain the referenced GitHub repo URL from the metadata and clone it yourself; 2) Inspect scripts/master_media.ps1 for any network calls, file operations, or calls to other binaries; 3) Verify that any ffmpeg commands in the script do only local re-encoding/remuxing and do not upload data; 4) Avoid running PowerShell with -ExecutionPolicy Bypass on untrusted scripts — run in a sandboxed VM or isolated environment if possible; 5) Prefer to fetch the code from the official repo and confirm its integrity (commit hash, maintainer) rather than running a missing script from an unspecified source. If the author can provide the missing script in the package or a clear install step that fetches a signed/verified release, re-evaluate; otherwise treat this package as incomplete and potentially risky.

Type: OpenClaw Skill Name: audio-mastering-cli Version: 1.0.2 The skill is designed for audio mastering using `ffmpeg` and PowerShell. It is classified as suspicious due to a critical shell injection vulnerability identified in the `SKILL.md` file. The instructions for the OpenClaw agent directly embed user-provided file paths (`<ruta-archivo>`) into `powershell` and `ffmpeg` commands without any explicit sanitization. This flaw could allow a malicious user to inject arbitrary commands, potentially leading to remote code execution if the OpenClaw agent does not robustly sanitize inputs before execution. There is no evidence of intentional malicious behavior such as data exfiltration, persistence, or obfuscation.