← 返回 Skills 市场

Creative Ops Copilot

Name: Creative Ops Copilot
Author: wiseape11

作者 Wiseape11 · GitHub ↗ · v0.1.0

cross-platform ⚠ suspicious

788

总下载

当前安装

版本数

在 OpenClaw 中安装

/install creative-ops-copilot

功能描述

Convert client briefs into detailed motion design/VFX production plans, estimates, and invoice drafts with optional project folder setup and invoicing API in...

使用说明 (SKILL.md)

Creative Ops Copilot

What to do

Ask for (or infer) the input brief:

Paste text directly, or
Provide a file path to a brief/email/thread export.

Produce these outputs (always):

docs/creative-ops/plan.md (client-ready)
docs/creative-ops/estimate.json (structured line items)
docs/creative-ops/invoice-draft.json (ready for API import later)

If Chris wants it, also:

Create a project folder skeleton (AE/C4D/Octane-friendly) with a docs/README.md.
POST the invoice draft to the local invoicing API (only if base URL is configured and Chris says “push it”).

Canonical output structure (plan.md)

Project summary (one paragraph)
Goals / Success criteria
Deliverables (matrix)
- Format, duration, aspect ratios, versions, audio deliverables
Workflow assumptions
- what’s included, what’s not, number of review rounds
Open questions (what you still need answered)
Production plan
- phases + milestones + review windows
Risks / dependencies
Estimate
- line items + hours + rate + subtotal + contingency
Next actions

How to generate reliably

Prefer generating structured data first, then render it:

Extract entities

Client name
Project name
Deadline/date constraints
Deliverables list
Constraints (brand, legal, footage supply, approvals)

Decide the production approach

Template-driven vs bespoke
2D AE vs 3D C4D vs mixed

Estimate with motion/VFX realism

Prepro (briefing, styleframes, boards)
Production (anim, 3D, comp)
Audio/music/licensing (if applicable)
Renders, exports, versioning
PM/admin buffer

Scripts (recommended)

Use the bundled script to create consistent outputs:

python skills/creative-ops-copilot/scripts/creative_ops_copilot.py --brief "\x3Cpaste brief>" --out .

If the brief is a file:

python skills/creative-ops-copilot/scripts/creative_ops_copilot.py --brief-file "C:\path	o\brief.txt" --out .

To also create a project skeleton:

python skills/creative-ops-copilot/scripts/creative_ops_copilot.py --brief "..." --out . --skeleton

To attempt pushing the invoice draft to your local invoicing API (only if configured):

python skills/creative-ops-copilot/scripts/creative_ops_copilot.py --brief "..." --out . --push-invoice

Configuration

Optional config file:

skills/creative-ops-copilot/references/config.example.json

Copy to:

skills/creative-ops-copilot/references/config.json

Then edit:

invoicingApi.baseUrl
invoicingApi.apiKey (if needed)
rateCard defaults

Notes

Keep outputs concise, clean, and client-ready.
When anything is missing/ambiguous, surface it under Open questions instead of guessing.

安全使用建议

This skill appears to do what it says: convert briefs into plan/estimate/invoice draft files and optionally create a project folder. Before using or enabling it: 1) Inspect and, if needed, edit skills/creative-ops-copilot/references/config.json — set invoicingApi.baseUrl only to a trusted local/organizational endpoint and avoid storing sensitive API keys unless necessary; 2) Run the script in a controlled directory to see what files it creates (it writes docs/creative-ops/* and optionally a project folder); 3) Be aware that enabling autonomous invocation (platform default) could let the agent run the script and, if configured and instructed to “push it,” send the invoice payload to the configured baseUrl — that network action is explicit and opt-in. If you want tighter control, keep invoicingApi.baseUrl unset or leave apiKey empty until you explicitly configure it.

功能分析

Type: OpenClaw Skill Name: creative-ops-copilot Version: 0.1.0 The skill bundle is classified as suspicious due to two significant vulnerabilities found in `scripts/creative_ops_copilot.py`. Firstly, the `--brief-file` argument allows the script to read arbitrary files from the filesystem (e.g., `/etc/passwd`) and embed their content into the generated `plan.md`, posing an arbitrary file read risk if the agent is compromised. Secondly, the `--push-invoice` functionality, while intended for a local invoicing API (defaulting to `http://localhost:8081` in `references/config.example.json`), can be configured via `invoicingApi.baseUrl` to send sensitive invoice data to any arbitrary external URL, creating a potential data exfiltration vector if misconfigured. There is no clear evidence of intentional malicious behavior within the bundle itself, but these capabilities present significant risks.

能力评估

✓ Purpose & Capability

Name/description align with the included script and SKILL.md. Required resources are minimal (no env vars, no external binaries). The invoicing API fields in the example config are directly related to the advertised 'push invoice' feature.

✓ Instruction Scope

SKILL.md limits actions to ingesting a brief (text or file), generating structured outputs and optional local project skeleton creation, and only posting to an invoicing API when configured and explicitly requested. It does not instruct the agent to read unrelated system files or env vars.

✓ Install Mechanism

No install spec — instruction-only plus a bundled Python script. This has low install risk; it expects a Python runtime but does not download or execute external code.

ℹ Credentials

The skill requests no environment variables. It does support an optional invoicingApi.apiKey in a local config file; storing an API key is reasonable for the 'push invoice' feature but the user should ensure the baseUrl is a trusted endpoint and avoid placing sensitive keys in configs unless necessary.

✓ Persistence & Privilege

always is false and the skill does not modify other skills or system-wide settings. It writes outputs to an output path/skeleton (normal). The skill can be invoked autonomously by the agent (platform default), but there are no additional elevated privileges requested.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install creative-ops-copilot
安装完成后，直接呼叫该 Skill 的名称或使用 /creative-ops-copilot 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v0.1.0

Initial release

元数据

Slug creative-ops-copilot

版本 0.1.0

许可证 —

累计安装 2

当前安装数 2

历史版本数 1

常见问题