Reelclaw

Create, produce, and schedule UGC-style short-form video reels at scale. Full pipeline: source UGC reaction hooks from DanSUGC, analyze app demos with Gemini...

Things to check before installing/use: - Resolve the metadata mismatch: the registry claims no required binaries/keys but SKILL.md expects ffmpeg/ffprobe/python3, GEMINI_API_KEY, and MCP access to DanSUGC and Post-Bridge. Ask the publisher to update registry metadata. - Only provide DanSUGC and Post-Bridge API keys if you trust those services; adding them to MCP stores credentials for the agent to use and may incur charges (DanSUGC requests cost credits per call). - The skill uploads videos to tmpfiles.org by default — this makes assets publicly accessible. If you need private hosting, change that step before use or confirm Post-Bridge can accept direct uploads. - The font download comes from cufonfonts.com (not an official repo). Prefer obtaining TikTok Sans from an authoritative source (project repo or trusted font host) and verify integrity before using. - The DanSUGC 'scrapecreators_raw' proxy exposes raw scraping endpoints; be careful with legal/privacy constraints when scraping third-party platforms. - If you plan to run the skill, test it in a sandboxed environment first (no production API keys), and avoid running the automatic package-install commands with elevated privileges until you review them. If you want, I can produce a short checklist of concrete questions to ask the publisher or a sanitized version of the SKILL.md that removes public-upload and third-party font steps.

Type: OpenClaw Skill Name: reelclaw Version: 0.1.0 The skill bundle automates a video production pipeline but performs several high-risk operations, including installing system packages via 'sudo apt-get' and downloading/extracting files from third-party URLs (cufonfonts.com) in SKILL.md. Additionally, it uploads local video files to a public hosting service (tmpfiles.org) to facilitate social media scheduling via the Post-Bridge API, which poses a privacy risk. While these actions align with the stated purpose, the combination of system-level modifications and public data exposure warrants a suspicious classification.