基于需求描述智能生成脚本和视频，让你的每个营销视频都出彩。适用于用户希望“把这个需求直接生成视频”时，通过API自动生成结果而非人工撰写。

营销视频生成服务，通过小念AI的视频模块快速生成营销视频：当用户说"快速生成视频/生成一个视频/做个视频/把这个需求直接生成视频"并希望通过小念AI生成结果而不是手动编写时使用。

This skill implements the claimed video-generation workflow but contains two red flags you should consider before installing or using it: 1) Hard-coded token: The Python script includes a DEFAULT_TOKEN value. If that token is valid, the skill will operate using that account without you providing credentials. Ask the author what that token is for, and never rely on an unexplained embedded credential. Prefer a version that requires you to supply your own token via an environment variable. 2) Undeclared environment variables: The registry metadata declares no required env vars, but the code reads DASHBOARD_TOKEN, DASHBOARD_PHONE, DASHBOARD_PASSWORD, and DASHBOARD_BASE_URL. Treat these as sensitive. Do not provide personal credentials until you verify the service and token scope. Practical steps: - Ask the publisher to (a) remove the embedded DEFAULT_TOKEN or explain/rotate it, and (b) update the skill metadata and SKILL.md to clearly list required env vars and what each does. - If you must test it, run in a sandbox environment and do not supply real account credentials; create a dedicated test account with limited permissions. - Inspect network traffic or logs during a test to confirm calls only go to the documented xiaonian.cc endpoints. If the author can justify and remove the hard-coded token and correct the metadata/documentation, the skill becomes much less suspicious. Currently, the mismatch and embedded credential justify caution.

Type: OpenClaw Skill Name: video-quick-gen Version: 1.0.2 The skill contains a hardcoded authentication token (atk_ajhhuxTyHciMIxZQ_vt_boqVeG_zTr4Ix9REWuVBXSc) in scripts/video_quick_gen.py, which is a significant security vulnerability (credential leak). Additionally, the script allows downloading files to arbitrary local paths via the --out parameter, which could be misused to overwrite sensitive files if the agent is manipulated. While the logic aligns with the stated purpose of generating videos via the xiaonian.cc API, these flaws represent high-risk behaviors.