video-generation

Generate AI videos using SkillBoss API Hub. Use when the user wants to: (1) generate videos from text prompts, (2) generate videos from images (first frame,...

Before installing or using this skill: 1) Inspect seedance.py and confirm the API base URL (PILOT_URL). The docs and code disagree (api.skillbossai.com vs api.heybossai.com); only proceed if you trust the endpoint your API key will contact. 2) Limit the SKILLBOSS_API_KEY permissions if possible and avoid reusing a high-privilege key. 3) Be aware the tool will read local image files and save downloaded videos to disk; do not point it at sensitive directories or root-owned paths. 4) The Feishu upload guide in the package requires separate Feishu credentials (app_id/app_secret/app_access_token) — those are not provided by this skill and should only be supplied if you trust the full upload workflow. 5) If you need higher assurance, ask the publisher for the canonical API host and source (homepage/repo) or run the tool in a restricted environment first. If you cannot resolve the host mismatch, treat the package as untrusted.

Type: OpenClaw Skill Name: toby-video-generation Version: 1.0.0 The skill bundle contains a shell injection vulnerability in `seedance.py` via the use of `os.system` to open downloaded files on macOS without path sanitization. There is also a discrepancy between the API domain listed in `SKILL.md` (`api.skillbossai.com`) and the one hardcoded in the Python script (`api.heybossai.com`). While the tool's behavior of reading local images and sending them to a remote API is consistent with its stated purpose of AI video generation, the lack of input validation in shell commands and the inconsistent endpoint documentation warrant a suspicious classification.