media-processor

OpenClaw 核心素材加工工具。支持对图片和视频（含 URL、m3u8、mp4）进行自动化处理，包括下载、压缩、添加水印和格式转换。

This skill appears to do what it says: download and process images/videos using ffmpeg and Pillow. Before installing, consider: (1) you must have FFmpeg available on the host (or rely on static-ffmpeg from pip); (2) the skill will download arbitrary HTTP/HTTPS inputs and write temporary files to /tmp and outputs to ./data/media or the input directory — avoid using untrusted URLs or run inside a sandbox to limit risk from malicious/malformed media; (3) ffmpeg and media libraries can be vulnerable to specially crafted files, so process untrusted inputs in an isolated environment and keep ffmpeg up to date; (4) the skill does not request secrets or network callbacks, but verify your runtime environment (permissions, disk space) before use.

Type: OpenClaw Skill Name: media-processor-agent Version: 1.1.0 The media processor skill lacks input validation on the 'input' parameter in run.py, allowing for arbitrary local file reads and potential Server-Side Request Forgery (SSRF) via remote URLs. While these capabilities are aligned with the tool's stated purpose of processing images and videos, the absence of path sanitization or URL whitelisting constitutes a security vulnerability that could be exploited to access sensitive system files (e.g., /etc/passwd) or internal network resources.