Terrain Route Video

Generate a minimalist terrain-style animated driving route video (MP4) from a list of stops (cities/POIs) without Remotion. Uses OSRM for road-following geom...

This skill appears to do what it says, but note three practical things before running: (1) The script sends coordinates to public services (router.project-osrm.org and a.tile.opentopomap.org) — if your stops/GPX contain sensitive location data, consider anonymizing them or running a private routing/tile service. (2) It creates local folders (frames/ and .tile-cache/) and caches tiles on disk; run it in a dedicated working folder and delete caches when you’re done. (3) Ensure ffmpeg is installed and on PATH; the script will call it via subprocess. If you need stronger privacy or to avoid external network calls, you would need a local OSRM/tile server or to modify the script to use only local tiles/tracks.

Type: OpenClaw Skill Name: terrain-route-video Version: 0.2.0 The skill is classified as suspicious due to a potential arbitrary file read vulnerability. The `scripts/terrain_route_video.py` script accepts a `--font` argument, which defaults to a system path (`/System/Library/Fonts/Hiragino Sans GB.ttc`). If an OpenClaw agent allows user-controlled input for this argument without proper sanitization, an attacker could specify an arbitrary file path (e.g., `/etc/passwd` or `~/.ssh/id_rsa`) to attempt to read its contents via `matplotlib.font_manager.FontProperties(fname=...)`. While there is no evidence of intentional malicious behavior like data exfiltration or backdoors, this vulnerability could lead to information disclosure.