Skill Tiktok Video Pipeline

End-to-end TikTok ad video pipeline. Product script → Veo base video → animated caption overlay → audio mix → final MP4. One command, full automation.

This package appears to implement a TikTok video pipeline but has several inconsistencies you should resolve before running it: (1) SKILL.md and scripts expect an API key (GEMINI_API_KEY) but the registry metadata doesn't declare it — if you provide that key it will be sent to the Veo/Gen service when generating video. (2) The Node and Python orchestrators reference other skills and script paths that are inconsistent with the files included (veo3-video-gen, skill-runway-video-gen, skill-tiktok-ads-video). That means the pipeline may fail or attempt to run code from other folders in your workspace if present. (3) The scripts run shell commands ('bash -lc', ffmpeg, ffprobe, 'uv run') and forward the entire process environment to subprocesses, so avoid running this with sensitive credentials in your environment. Recommended steps before installing/running: run this in an isolated environment or container; inspect and, if necessary, correct the path references to the other skills or ensure the required helper skills are intentionally present; use the provided dry-run mode to test overlay behavior; do not run with sensitive env vars set (or sanitize env) until you confirm behavior; and review any external skills (veo/runway) that this orchestrator expects to call. Because of the mismatches and env handling, treat this as untrusted until you verify/correct those issues.

Type: OpenClaw Skill Name: skill-tiktok-video-pipeline Version: 2.0.0 The `scripts/tiktok_overlay_engine_v3.py` script is vulnerable to `ffmpeg` filter injection. User-controlled arguments like `--pill-color` and `--text-color` are directly concatenated into the `ffmpeg` `drawtext` filter string without proper escaping, allowing an attacker to inject arbitrary `ffmpeg` filters. This can lead to information disclosure, denial of service, or potentially remote code execution. While `scripts/generate.js` uses `JSON.stringify` to mitigate direct shell injection for its arguments, the downstream `tiktok_overlay_engine_v3.py` script introduces a critical vulnerability.