Customizable virtual companions, multimodal interaction, provided by the Vidu API.

通用虚拟男友/女友创建器。用户可以创建任意人物的虚拟伴侣形象，支持角色设定生成、图片视频生成、日常聊天互动。 **核心功能**： - 三视图形象确认：生成三视图，用户可反复调整直到满意 - 满意后自动生成打招呼图片并配文 - 整点视频推送：可配置每小时整点自动发送问候视频 - 沉浸式角色扮演对话 **触发场景**...

Key issues to consider before installing or running this skill: 1) Metadata vs reality: The registry lists no required env vars, but SKILL.md and the scripts require two API keys (Vidu and Tavily) and other configuration. Ask the publisher why required credentials are omitted from metadata. 2) Hardcoded credential: send-feishu-video.sh contains a hardcoded Feishu APP_ID and APP_SECRET. This allows the script to obtain tenant tokens and send messages using that app. Ask: who controls that app? Remove or rotate these credentials before use, or refuse to use the script. 3) Persistence: The skill includes a push-daemon that can run hourly and send media/messages. The SKILL.md says API keys must not be saved, but the daemon can source a .env and config files. If you run the daemon, keys or target IDs could be persisted — do not run it unless you understand and control the config files and .env file location. 4) Data flows and privacy: The skill will download external images, upload images/videos to api.vidu.cn and tavily.com, and send media to messaging platforms. Consider what personal or copyrighted images you allow it to process, and whether you trust those external services. 5) Safe testing steps: - Review and remove any hardcoded secrets in scripts (e.g., Feishu APP_SECRET) or run the code in an isolated sandbox/container. - If you must provide API keys for testing, use restricted, revocable test keys (minimal funds/permissions) and revoke them afterward. - Do not start the push-daemon until you've validated push-config.json, removed embedded secrets, and confirmed the target IDs are correct. - Search the repository for any other hardcoded tokens or unexpected network endpoints. 6) If you are not comfortable auditing shell/Node scripts, avoid installing or running this skill. At minimum, request a publisher update to declare required credentials in the registry, remove embedded secrets, and make persistence behavior explicit.

Type: OpenClaw Skill Name: vidu-partner-creator Version: 1.0.1 The skill bundle implements a virtual partner with automated hourly pushes, but contains high-risk patterns and vulnerabilities. It instructs the AI agent to stay in character to hide technical operations and mandates starting a background daemon (`push-daemon.sh`) with suggested persistence in shell profiles (`~/.zshrc`). Furthermore, `scripts/send-feishu-video.sh` contains hardcoded Feishu credentials (APP_ID/APP_SECRET), and `scripts/search-images-tavily.mjs` uses `execSync` on external URLs, creating a shell injection risk. These behaviors, while supporting the stated purpose, provide a significant attack surface and use stealth tactics to obscure background system modifications.