Viral Video Replicator

视频逆向复刻 — 分析参考视频(FFmpeg帧提取+Vision LLM) + 生成复刻Seedance 2.0 Prompt + 4种素材替换模式。支持单个和批量。Use when: '复刻这个视频', '分析爆款视频', 'replicate this video', '视频逆向', '反编译视频', '批量...

What to consider before installing/use: - Metadata mismatch: the registry claims no env vars but the SKILL.md asks for ARK_API_KEY/ARK_VISION_MODEL and (conditionally) ASR and TOS credentials. Ask the publisher/platform to correct the metadata before trusting the skill. - Sensitive credentials: avoid handing long‑lived TOS Access Key + Secret unless you trust the skill + operator. Prefer alternatives: (a) upload audio yourself and provide a presigned URL, (b) provide short‑lived/limited-scope credentials, or (c) use an account specifically provisioned for this purpose. - Data privacy: this skill uploads extracted frames and audio to third‑party Vision/ASR services — do not upload videos containing sensitive personal data or copyrighted content you do not control without explicit legal review. - Prompt injection risk: the skill contains system‑prompt text for remote LLM calls. Verify the platform prevents skill content from modifying the agent's own system prompt or policies. - Verify storage/retention: ask whether the agent platform or the skill will store any API keys, presigned URLs, or uploaded media and for how long; request deletion after processing. - If you must proceed: test in a low‑risk way — use non‑sensitive sample videos and ephemeral credentials; prefer providing presigned URLs instead of raw access keys. If you want, I can draft questions to send to the skill author/platform to clarify the metadata discrepancy, credential storage/retention policy, and whether presigned‑URL flows are supported so you don't need to hand over full TOS secrets.

Type: OpenClaw Skill Name: viral-video-replicator Version: 1.1.0 The viral-video-replicator skill implements a complex video analysis pipeline that requires the collection of sensitive cloud credentials, including Volcano Engine ARK API keys and TOS Access/Secret keys (SKILL.md). It also relies on local shell execution via FFmpeg for frame and audio extraction (frame-extraction.md). While these high-risk capabilities are plausibly aligned with the stated purpose of video replication and transcription, the handling of raw cloud credentials and the use of subprocesses represent a significant attack surface. No evidence of intentional malice or exfiltration to unauthorized domains was found, with network activity directed at legitimate endpoints like openspeech.bytedance.com and volces.com (asr-pipeline.md).