Remotion Video Generator

AI video production workflow using Remotion. Use when creating videos, short films, commercials, or motion graphics. Triggers on requests to make promotional...

Before installing or running this skill, consider the following: 1) The included scrapling.sh will fetch and parse any URL you pass and will send a constructed screenshot request to thum.io — this can reveal the target URL and site metadata to third parties. Avoid scraping sensitive/internal sites. 2) The workflow instructs exposing your local Remotion Studio via a Cloudflare tunnel and sharing the public URL; do not run that step for projects that contain private data, credentials, or unpublished content. 3) The SKILL.md references another skill's tunnel script but does not declare any Cloudflare credentials — check what credentials that tunnel requires and never provide secrets to a skill you don't trust. 4) The skill recommends installing the 'scrapling' Python package; verify the package source and review its code before pip installing into any production environment. 5) If you decide to run it, do so in an isolated environment (container or VM), review the scripts line-by-line, and manually run only the steps you understand (especially scraping and tunneling). If you want higher assurance, ask the author for a homepage/repository and for explicit details about the scrapling package and the tunnel script it references.

Type: OpenClaw Skill Name: remotion-video-generator Version: 1.0.0 The skill is classified as suspicious due to critical shell injection vulnerabilities and the instruction to publicly expose a local development server. The `scripts/scrapling.sh` script directly embeds unsanitized user-provided URLs into a Python script string, creating a remote code execution risk. Similarly, `scripts/remotion.sh` directly embeds arguments into shell commands without sanitization. Furthermore, `SKILL.md` explicitly instructs the agent to use `cloudflare-tunnel/scripts/tunnel.sh` to expose the Remotion Studio (running `npm run dev`) on port 3000 publicly, significantly increasing the attack surface and potential for exploitation of the agent's environment.