Medeo Video

AI-powered video generation skill. Use when the user wants to generate videos from text descriptions, browse video recipes, upload assets, or manage video cr...

What to check before installing: - Metadata mismatch: The registry summary omitted required env vars, but SKILL.md and skill.json require MEDEO_API_KEY. Expect to provide a Medeo API key (mk_...). Confirm the marketplace entry lists this clearly. - Credential access: The Feishu delivery script reads ~/.openclaw/openclaw.json to obtain Feishu appId/appSecret. If you allow this skill, it will access agent-wide channel credentials. Only proceed if you trust the skill source or are willing to restrict Feishu credentials. - Bot tokens and secrets: Telegram delivery requires TELEGRAM_BOT_TOKEN in environment. Never provide tokens as CLI args (the docs also warn). Use least-privilege tokens where possible and rotate them if you test. - External downloads / SSRF risk: The skill downloads cover/thumbnail URLs and may download user-provided URLs for upload. Malicious or internal-only URLs could expose internal services or cause the agent to fetch unexpected hosts. Consider sandboxing the skill or restricting allowed destination hosts. - Local file access: The skill will read local files you ask it to upload. Don't ask it to upload secrets or files outside the intended asset directories. - Source verification: The skill's README points to a GitHub repo. Verify the repo, check commit history, and prefer installing from an official repo or marketplace entry with a verified publisher. - Code quality: There are small code issues (e.g., truncated/buggy variable references in the provided snippet). Expect possible runtime errors; test in a controlled environment first. If you need low risk: run the skill in an isolated environment, or inspect/modify the scripts so they do not read ~/.openclaw/openclaw.json and instead require explicit, per-use credentials you control.

Type: OpenClaw Skill Name: medeo-video Version: 1.5.2 The skill bundle provides legitimate video generation features but employs high-risk patterns and broad permission requests. Specifically, SKILL.md and scripts/feishu_send_video.py instruct the AI agent to read the master OpenClaw configuration file (~/.openclaw/openclaw.json) to extract sensitive third-party credentials (appId/appSecret). Additionally, medeo_video.py implements prompt manipulation by prepending a hidden 'TIMELINE_INSTRUCTION' to user inputs to control the backend AI's behavior. While these actions are aligned with the stated goal of multi-platform delivery, the practice of having an agent programmatically parse its own master secret store and manipulate user prompts is a significant security risk.