Full AI pipeline to create dark motivational TikTok/Reels videos using REAL video footage. Generates script (Claude), voiceover (ElevenLabs), searches real dark/cinematic video clips from Pexels API (no AI image generation), adds animated text overlays (MoviePy), color grading (FFmpeg), and exports final 1080x1920 MP4. Use this skill for: motivation video, dark

Full AI pipeline to create dark motivational TikTok/Reels videos using REAL video footage. Generates script (Claude), voiceover (ElevenLabs), searches real d...

Before installing: (1) Expect to provide three API keys (Anthropic/Claude, ElevenLabs, Pexels) even though the package metadata doesn't list them — verify and store them securely (use least-privilege keys if possible). (2) Inspect pipeline_full.py (we reviewed it) and confirm you are comfortable with it downloading and writing video/audio files to the local filesystem; run it in an isolated environment (container or VM) if you don't fully trust it. (3) The SKILL.md includes a system prompt to force JSON output from Claude — this is normal for parsing but should be audited to ensure it doesn't attempt to override the agent's broader system prompts. (4) Ensure you have legal/usage rights for Pexels content and ElevenLabs voice usage, and install FFmpeg and the recommended font safely. (5) If you plan to allow autonomous agent invocation, consider the blast radius of the API keys you supply; otherwise run manually. If the registry metadata cannot be corrected to list the required env vars, treat the omission as a red flag and obtain clarification from the publisher before use.

Type: OpenClaw Skill Name: tiktok-motivation-video Version: 1.0.0 The skill bundle exhibits critical vulnerabilities related to file system operations. Specifically, the `output` argument, which is user-controlled via CLI, is used directly as the output path for the final video in `pipeline_full.py` without sanitization. This allows for arbitrary file overwrite (e.g., `python pipeline_full.py --output ../../../../etc/passwd`), which is a significant security flaw. Additionally, the `bg_music_path` argument allows checking for the existence of arbitrary files via `os.path.exists()`. While the skill's primary purpose is benign, these vulnerabilities could be exploited for data destruction or information leakage. The prompt injection vulnerability against the Claude API is also present, though its direct impact on the execution environment is limited by the skill's design to parse JSON output.