Video Proof

Record video proof of implemented features after coding tasks complete. Use when a coding agent finishes work and needs to visually verify and demonstrate th...

This skill appears to do what it says: start your app, run scripted steps, and capture video/screenshots/logs. Before using it: (1) inspect any proof-spec.yaml provided by an agent — the start_command field runs exactly what you put there and can execute arbitrary shell commands; (2) run scripts/setup.sh only on machines you control (it will download npm packages, Playwright browser binaries, and may attempt to use sudo to install ffmpeg); (3) avoid pointing base_url at sensitive external services or endpoints with secrets — api-proof.js will send HTTP requests to whatever URL you configure; (4) prefer running in an isolated environment (local dev VM, CI runner, or container) rather than on a machine with sensitive credentials. If you want, run the scripts manually once to verify behavior before integrating into an automated agent workflow.

Type: OpenClaw Skill Name: video-proof Version: 1.0.2 The skill bundle is suspicious due to a critical shell injection vulnerability. Both `scripts/api-proof.js` and `scripts/record-proof.js` directly execute the `start_command` from the `proof-spec.yaml` (or CLI arguments) using `spawn('sh', ['-c', spec.start_command])`. This allows arbitrary shell commands to be executed, leading to Remote Code Execution (RCE) if a malicious `proof-spec.yaml` is provided by an agent or user. Additionally, `scripts/setup.sh` uses `sudo` for installing dependencies, which, while intended for legitimate purposes, represents a privilege escalation capability.