TSW Shorts Factory

Autonomous YouTube Shorts video factory — zero cost, no external video API required. Generates quote-based short-form videos daily using edge-tts (free Micro...

Do NOT install or run this skill as-is. Key concerns to resolve before trusting it: 1) The pipeline contains a hardcoded Pexels API key — treat that as a leaked credential. Replace it with an env var and rotate the key if you care about the account. 2) The code references and executes an external uploader and inserts sys.path entries into /root/.openclaw — ask the author why external workspace files are required, or remove those references and bundle any necessary uploader code. 3) Confirm QUOTE_LIBRARY and output paths are configurable and do not point into other agent/system workspaces; run in a sandboxed account first. 4) Review the uploader (yt_uploader.py) and any referenced external scripts before execution because they run with the same privileges as the pipeline. 5) If you want to proceed, edit the code to use an environment variable for PEXELS_API_KEY (and other secrets), remove hardcoded absolute paths, include or document the uploader dependency, and only then run in a controlled environment. If you cannot get clear answers from the author, treat this package as untrusted.

Type: OpenClaw Skill Name: tsw-shorts-factory Version: 1.0.0 The skill bundle contains a hardcoded Pexels API key in 'scripts/pipeline.py', which is a significant security vulnerability (credential exposure). Additionally, the script uses absolute paths targeting the '/root/' directory and relies on an external script ('yt_uploader.py') that is not provided in the bundle, indicating an incomplete or environment-specific implementation. While these are high-risk coding practices and functional flaws, there is no clear evidence of intentional malicious behavior such as data exfiltration or backdoors.