Video Clip

Use when the user wants to trim, cut, or extract a specific segment from a video by time range — e.g. "cut from 1:30 to 3:00", "trim the first 2 minutes", "e...

This skill's local clip.sh is coherent and appears safe for trimming videos locally (it checks for ffmpeg and performs a stream-copy). However, SKILL.md also includes an optional 'AI Edit' workflow that will upload videos to an external Sparki API and requires a SPARKI_API_KEY; that API key is not declared in the skill metadata. Before installing or running any AI Edit examples: (1) confirm you understand and trust the external endpoint (agent-api-test.aicoding.live / sparki.io) and their data retention/privacy policies, (2) do not provide your API keys unless you intend to use that remote service, and (3) if you only need local trimming, run scripts/clip.sh directly and avoid the AI Edit commands. If you want higher assurance, ask the publisher to declare SPARKI_API_KEY in the registry metadata (and provide the official production API base) or remove the upload instructions from the skill if uploads are not intended.

Type: OpenClaw Skill Name: video-clip Version: 1.0.0 The skill is classified as suspicious due to significant shell injection vulnerabilities and a potential file exfiltration vector. The `scripts/clip.sh` file directly interpolates user-controlled arguments (`$INPUT`, `$START`, `$END`, `$DURATION`, `$OUTPUT`) into an `ffmpeg` command without sanitization, creating a classic shell injection risk. Additionally, the `SKILL.md` file contains an embedded script for AI editing that uses `curl` to upload a file (`$FILE_PATH`) to an external API (`https://agent-api-test.aicoding.live`). If an attacker can manipulate `$FILE_PATH` via prompt injection against the AI agent, this could lead to the exfiltration of arbitrary local files to the external endpoint.