Product Demo Video Creator

Create product demo videos with voiceover, text overlays, and real browser interactions. Fully automated, zero cost. Uses Puppeteer (headless Chrome), edge-t...

This skill is coherent with its stated purpose, but take these precautions before running: - Inspect and (if needed) edit SCENES in scripts/record-demo.mjs so they only point to public pages you control; do NOT point it to authenticated or private pages unless you understand the privacy risk (screenshots capture page content). - Review any narration or scene id content before running; the script uses execSync with string commands (edge-tts, ffmpeg, ffprobe). Avoid untrusted text that could include shell metacharacters. Prefer running the script manually in a sandbox first. - Be careful running scripts/install-deps.sh: it downloads an FFmpeg static build and copies binaries to /usr/local/bin (requires elevated privileges). Consider installing dependencies through your package manager or verifying the downloaded archive before copying. - Expect edge-tts to contact Microsoft servers (network activity). If offline or privacy-sensitive, do not generate TTS there. - Run the whole workflow in an isolated environment (VM/container) or non-production machine until you’re comfortable. If you plan to adapt the code, consider replacing execSync string commands with child_process spawn/execFile and validated argument lists to avoid shell injection. If you want, I can point out the specific lines in record-demo.mjs that are highest risk and suggest safer code changes.

Type: OpenClaw Skill Name: product-demo-video Version: 1.0.0 The skill bundle contains a shell injection vulnerability in `scripts/record-demo.mjs` where narration text is passed to `execSync` with insufficient sanitization (only double quotes are escaped), allowing for subshell execution (e.g., via backticks or $()). Additionally, `scripts/install-deps.sh` downloads and installs a pre-compiled FFmpeg binary from an external site (johnvansickle.com), which is a high-risk supply chain practice. While these behaviors are functional for the stated purpose of video generation, they represent significant security flaws that could be exploited by a malicious prompt.