Qcut Video Edit

Run QCut's native TypeScript pipeline CLI for AI content generation, video analysis, transcription, YAML pipelines, ViMax agentic video production, and proje...

What to consider before installing or running this skill: - The SKILL.md expects you to have and run local developer tools (bun, electron) and the qcut pipeline. The skill metadata does not declare those required binaries — confirm you have the intended QCut application and that these commands are safe in your environment. - The instructions access local configuration (~/.qcut/.env) and include commands to set and reveal API keys. Never run commands that reveal secrets unless you explicitly trust the environment and understand where output goes. - The skill suggests reading other agent skill files (e.g., .agents/skills/...), which means it expects access to your agent's filesystem. If you do not want a skill to read other skill files or local configs, avoid running these commands or run them in an isolated environment (VM/container). - Building and launching (bun run build; bun run electron &) executes code on your machine. Treat that like running any unreviewed program — inspect upstream source or run in an isolated test environment first. - Ask the publisher for clarifications: a list of explicit required binaries, which local paths will be read/written, and why reading .agents/skills is necessary. Prefer installing only from a trusted homepage/source; this package has 'Source: unknown' and no homepage, which reduces provenance confidence. - If you need to proceed, run commands manually rather than letting an agent run them autonomously, and avoid using any --reveal or other flags that expose full secret values.

Type: OpenClaw Skill Name: qcut-video-edit Version: 2026.3.5 The skill bundle is classified as suspicious due to several high-risk capabilities and potential vulnerabilities exposed through its commands. Specifically, the `bun run pipeline get-key --name <name> --reveal` command (documented in `reference-pipelines.md`) allows direct retrieval of sensitive API keys stored locally. Additionally, the 'Notification Bridge' feature (documented in `editor-state-control.md`) enables forwarding of user actions from the QCut application to the Claude PTY session, posing a privacy risk through potential monitoring. Furthermore, commands accepting arbitrary URLs (e.g., `--image-url`, `--url` in `REFERENCE.md`, `editor-media.md`) and HTML content (e.g., `--html` in `editor-output.md`) could lead to SSRF/LFI or XSS vulnerabilities in the underlying QCut application if not properly sanitized. While these are documented features, they represent significant security risks if misused or exploited, indicating a suspicious rather than benign nature, without clear evidence of intentional malicious exfiltration or backdoor installation by the skill itself.