Showcase Video Builder

Build polished showcase and demo videos from screenshots, avatars, and text overlays using ffmpeg. Use when creating demo reels, hackathon presentations, pro...

This skill appears safe and does what it says: run ffmpeg locally to build videos from images. Before running: ensure ffmpeg is installed from a trusted source, verify the images directory you pass to the script (it will process all PNGs there), and adjust the font path if you're not on macOS. The script honors FFMPEG env override if you need to point to a specific binary. If you allow an automated agent to invoke this skill, remember it will run ffmpeg commands on whatever image directory you (or the agent) provide — avoid passing sensitive system paths. If you need network/media uploads, handle those steps separately; this skill performs no network calls or credential handling.

Type: OpenClaw Skill Name: showcase-video-builder Version: 1.0.0 The skill's stated purpose is benign, focusing on local video processing with `ffmpeg`. However, the `scripts/build_showcase.sh` file contains a critical shell injection vulnerability. It constructs an `ffmpeg` command by directly embedding unquoted image filenames (`$img`) into the command string, allowing an attacker to execute arbitrary commands if they can control the filenames within the `IMAGES_DIR`. For example, a filename like `image.png; rm -rf /;` would lead to command execution. Additionally, the `FFMPEG` environment variable is used without sanitization, presenting another potential injection vector. These are severe vulnerabilities, but there is no clear evidence of intentional malicious behavior such as data exfiltration or persistence.