Video Monetization Pro

视频变现全流程自动化技能。从热点分析→MV 主题→歌词创作→法律审查→Suno 提示词→分镜脚本→一键发布→收益监控。专为视频创作者设计的端到端变现解决方案。

Key things to consider before installing: 1) Missing / inconsistent credential list: SKILL.md and scripts reference Google API keys, a Suno verification URL, YouTube OAuth, and other platform logins but the registry metadata only lists SUNO_PHONE and KLING_* keys. Ask the author to provide a single, accurate list of required secrets and explain where each is used. 2) Embedded example credentials/tokens: The repository contains an API token/verification URL (sms8.net) and concrete phone numbers/emails in docs and demo files. Treat these as leaked test data — do not reuse them. Ask the author to remove all embedded tokens and replace with placeholders before installing. 3) Hardcoded absolute paths and fixed persona: Scripts default to /Users/huang/... and insist on a fixed performer asset path and Bilibili UID. That is inappropriate for general use and could cause accidental reads/writes on your machine. Request the author make paths configurable (relative to the skill workspace or use $HOME) and remove forced identity constraints. 4) Publishing and automation risks: The skill outlines automated publishing to multiple platforms and auto-sent daily reports. Do not provide platform credentials or OAuth tokens until you review the publish scripts line-by-line and test them in a sandbox. Confirm how credentials are stored and whether tokens are ever transmitted to third parties. 5) Local file modification: legal-check.sh edits input files in-place via sed. Back up files before running. Prefer that the script write reports to separate outputs rather than modifying originals. 6) Test in a sandbox: Run the scripts in an isolated VM/container with no real credentials and with OUTPUT_DIR pointed to a safe directory. Inspect network calls (e.g., with tcpdump) to see what endpoints are contacted when you run each script. 7) Request changes or refuse install if unresolved: Ask the maintainer to - remove embedded tokens and personal emails/phone numbers, - document exactly which credentials are required (and add them to metadata), - replace hardcoded paths with configurable variables defaulting to the skill workspace or $HOME, - provide a minimal-mode that runs only analysis/lyrics generation without publishing or external credentials. If the author cannot justify these issues or fix them, treat the package as untrusted and do not install with real credentials.

Type: OpenClaw Skill Name: video-monetization-pro-84 Version: 1.0.0 The skill bundle contains multiple hardcoded sensitive credentials and API tokens, which is a significant security risk. Specifically, 'SKILL.md', 'README.md', and 'scripts/generate-suno.sh' include hardcoded Kling AI access keys (KLING_ACCESS_KEY, KLING_SECRET_KEY) and a specific SMS verification service token for 'api.sms8.net' (token=age41qfusk74s7g3po9sr2ljazq0omw4m3jz). While these appear intended to provide users with access to third-party services as part of the 'Pro' package, hardcoding secrets is a critical vulnerability. Furthermore, the use of an SMS bypass service suggests potential circumvention of platform terms of service. The scripts are primarily templates for generating local markdown reports and do not show clear evidence of intentional data exfiltration from the user.