RoughCut

Run RoughCut headlessly on macOS to generate Final Cut Pro (FCPXML) rough-cut timeline variants from a talking-head video — local-first, no media upload.

This skill is coherent with its purpose, but exercise normal caution: verify that the RoughCut repo exists at the REPO_ROOT you point to and audit $REPO_ROOT/scripts/openclaw/roughcut.sh before running (it will be executed by the agent). GEMINI_API_KEY is optional — only provide it if you enable fluff removal and you trust the model call. Prefer running the script manually once to confirm behavior and outputs, and ensure OUTPUT_ROOT and REPO_ROOT point to safe directories (so downloaded video and intermediate files aren't saved into sensitive locations).

Type: OpenClaw Skill Name: roughcut-openclaw Version: 1.0.0 The skill is classified as suspicious due to its reliance on executing an arbitrary local bash script (`roughcut.sh`) from a configured repository path and its capability to download content from arbitrary user-provided URLs (`--video-url`) using tools like `curl`, as specified in `SKILL.md`. While these capabilities are presented as necessary for the skill's stated purpose of video processing, they introduce significant attack surfaces. The content of `roughcut.sh` is not provided for analysis, and the arbitrary URL download feature could be exploited if the agent is prompted to fetch malicious payloads. There is no clear evidence of intentional malicious behavior (e.g., exfiltration, persistence) within the provided `SKILL.md` itself, but the inherent risks of these powerful operations warrant a 'suspicious' classification.