scarcest-not-money-video-gen

Create vertical scarcity-mystery shorts: not money, option teases, final reveal, timed English captions (WeryAI). Use for guess-the-answer hooks or motivatio...

This skill is coherent for creating short 'scarcity' videos using WeryAI. Before installing or running it: (1) Confirm you want to provide WERYAI_API_KEY — this key will be used for model queries, generation, and (if you pass local file paths) uploads that may consume credits. Prefer providing public https:// image URLs instead of local file paths. (2) If you plan to use local images, review scripts/video_gen.js yourself and explicitly consent before allowing the agent to read and upload files. (3) Use a limited-scope or test API key in development, and monitor billing/usage on the WeryAI account. (4) Ensure Node 18+ runtime is available. If you want extra assurance, run the script in an isolated environment or with a throwaway API key while testing.

Type: OpenClaw Skill Name: scarcest-not-money-video-gen Version: 1.0.0 The skill bundle contains a script `scripts/video_gen.js` that implements a high-risk capability: it can read arbitrary local files and upload them to a remote server (`api-growth-agent.weryai.com`) if a local path is passed via the `image` or `images` parameters. While this behavior is documented in `SKILL.md` and `WERYAI_VIDEO_API.md` as a feature for image-to-video generation, the script lacks path sanitization or strict file-type validation, creating a significant surface for data exfiltration if the AI agent is targeted by prompt injection. This vulnerability allows for the potential theft of sensitive files (e.g., SSH keys, credentials) despite the stated benign purpose.