Video Ai Process

Automatically transcribe, analyze, segment, upload, auto-compose, and generate custom-cut AI video editions with client scoring and final version selection.

This skill appears to implement the pipeline described, but it has notable inconsistencies you should resolve before installing or running it: - Missing runtime requirements: the code calls ffmpeg and imports faster_whisper but the registry lists no required binaries or packages. Ensure ffmpeg and the Python dependencies (faster-whisper, and any HTTP client/SDKs you plan to use) are installed from trusted sources. - Undeclared secrets: the SKILL.md and code expect FEISHU_VIDEO_APP_TOKEN and FEISHU_VIDEO_TABLE_ID and refer to a MiniMax integration, but these credentials are not declared in metadata. Do not provide secrets until the skill clearly documents why each is needed and how they will be used and stored. Rotate tokens after testing. - Secret leakage: the script prints Feishu token and table_id to stdout — logs can leak these. Remove or redact logging of secrets. - Cross-platform & path issues: the code mixes /tmp and Windows D:\ paths and hardcodes a workspace path insertion. Confirm the runtime environment (Windows vs Linux) and output locations; run in an isolated environment first. - Unimplemented network steps: several key network interactions (MiniMax API calls, Feishu API writes, heartbeats) are TODOs. Ask the author for the intended MiniMax API usage and whether any external endpoints are contacted other than Feishu and legitimate model hosts. Recommended actions before use: - Request updated metadata from the author that declares required binaries and env vars and documents MiniMax/Feishu endpoints and permission scope. - Review and modify the code to avoid printing secrets, and to clearly implement/explicitly show any network calls and endpoints used. - Run the code in an isolated/test environment with least-privilege tokens (scoped Feishu token) and confirm behavior (no unexpected outgoing connections). If you cannot verify these, treat the skill as untrusted.

Type: OpenClaw Skill Name: video-ai-process Version: 1.0.1 The skill bundle provides a video processing pipeline (Whisper, MiniMax, FFmpeg, and Feishu integration) but is classified as suspicious due to a shell injection vulnerability in `video_pipeline.py`, where `subprocess.run(shell=True)` is used with unsanitized input. The code also contains inconsistent hardcoded paths (mixing Windows `D:\` drives with Linux `/home/success/` directories) and several incomplete 'TODO' stubs. While these represent significant security flaws and poor coding practices, there is no clear evidence of intentional malicious behavior or data exfiltration.