clip-editor

Video clip editing skill for automatically analyzing video content and generating CapCut draft templates. Uses local Whisper for speech transcription, Qwen-V...

Key things to consider before installing or running this skill: - Network/data exfiltration: The code extracts frames and text and will send them to external APIs (Qwen-VL endpoint, Anthropic/Claude, edge-tts). If you will process private or copyrighted video, assume those fragments may be transmitted to third parties unless you review and disable those calls. - Undeclared requirements: The skill uses ffmpeg/ffprobe and will attempt to pip-install packages at runtime. The registry metadata does not declare these dependencies or install steps. Running it may modify your Python environment (the scripts use --break-system-packages). - Credentials: The scripts look for QWEN_API_KEY and ANTHROPIC_API_KEY (and will use them if present). The package did not declare these env vars. Only provide API keys if you trust the skill and understand which remote services will receive your data. - Mitigations: Run the skill in a sandboxed environment or VM, inspect the code locally, or run with network disabled if you only want local Whisper/edge-tts. Prefer creating an isolated Python virtualenv before running so the automatic pip installs cannot alter your system Python. Ask the publisher to update the registry metadata to declare required binaries, explicit optional env vars, and a proper install spec. - When in doubt: do not supply API keys or private video to this skill until the above inconsistencies are resolved or you run it in an isolated/safe environment.

Type: OpenClaw Skill Name: video-clip-editor Version: 1.0.0 The skill bundle provides complex video editing and CapCut draft generation capabilities but includes several high-risk behaviors. Multiple scripts (e.g., build_payload.py, narration_audio.py, and whisper_transcribe.py) contain logic to automatically install Python dependencies via 'pip' using the '--break-system-packages' flag, which can compromise the host environment's integrity. The skill also performs broad file system operations, such as scanning local JianYing/CapCut application directories for project conflict resolution, and makes extensive use of 'subprocess' to execute external binaries like ffmpeg and ffprobe. While these actions are aligned with the stated purpose, the combination of auto-installers, shell execution, and communication with multiple external APIs (Anthropic, DashScope, and Vectcut) represents a significant attack surface.