Video Pro by cza999

专业AI视频生成器，支持文本转高质量短视频，批量处理、多模板和高级自定义语音功能，适合创作者和企业。

This skill appears to be a legitimate text→video generator, but there are several things to check before installing: 1) The SKILL.md requires OPENAI_API_KEY and a license key but the package metadata doesn't declare them — expect to provide your OpenAI key and a license. 2) The scripts write license keys and user-provided scripts into files and logs under $HOME/.video-pro and the project output; the activation script saves and appends the license key in plaintext — avoid entering high-value or reused secrets until you trust the code and hosting. 3) The skill instructs you to clone an external GitHub repo (ZhenRobotics/openclaw-video) and to run npm install; inspect that repository for any network calls or unexpected scripts before running. 4) The SKILL.md advertises remote APIs/webhooks (api.video-pro.cza999.com) — those are external services; only send license keys or personal data to those endpoints after verifying the vendor. 5) Ensure your system has required tools (jq, ffprobe/ffmpeg, uuidgen, git, node, npm) — the manifest only lists git/node/npm; missing declarations are a sign to audit manually. Recommended actions: inspect the GitHub repo and the scripts in it, run the activation step in a restricted environment or with test keys, and avoid using production/OpenAI billing keys until you confirm there is no unexpected network exfiltration in the full codebase.

Type: OpenClaw Skill Name: video-pro-cza Version: 1.0.0 The skill bundle acts as a wrapper for a commercial video generation tool but introduces several high-risk behaviors. It instructs the agent to clone and execute code from an external GitHub repository (ZhenRobotics/openclaw-video.git), requires the user to provide sensitive API keys (OPENAI_API_KEY), and includes an activation script (activate-premium.sh) that collects system metadata such as the username and hostname for a local licensing file. While these actions are aligned with the stated commercial purpose, the reliance on external unverified code and the collection of system information represent a significant attack surface and potential for supply chain risk.