volcengine-video-generate

Using volcengine video_generate.py script to generate video, need to provide filename and prompt, optional provide first frame image (URL or local path).

This skill appears to be a simple wrapper over Volcengine's Ark content-generation API and downloads the resulting video, which aligns with its stated purpose. However: (1) the registry lists no required environment variables but the script needs an API key (MODEL_VIDEO_API_KEY or ARK_API_KEY) — be prepared to provide a valid key before running; (2) SKILL.md claims an additional fallback using VOLCENGINE_ACCESS_KEY and VOLCENGINE_SECRET_KEY, but that logic is not present in the code — treat that claim as inaccurate; (3) the script will send your text prompt and any provided image (it may convert a local image to a base64 data URI) to the Ark API and will download the returned video URL — only use with a trusted API endpoint and avoid embedding secrets in prompts or image metadata; (4) source and homepage are unknown — if you need stronger assurance, request provenance (author, official repo, or signed release) or run the script in an isolated environment. If you accept these caveats and can supply the required API key, the skill is usable; otherwise proceed cautiously or seek a version with clearer credential handling and provenance.

Type: OpenClaw Skill Name: volcengine-video-generate Version: 1.0.0 The `scripts/video_generate.py` script exhibits risky capabilities by allowing the reading of arbitrary local files (via the `first_frame_image` argument) and sending their base64 encoded content to the Volcengine API. Additionally, it permits writing the generated video to an arbitrary local path (via the `filename` argument), including creating directories. While these actions are plausibly needed for the skill's stated purpose (using local images and saving videos locally), they introduce a significant risk of data exfiltration or arbitrary file writes if an attacker can manipulate the input arguments, for example, through prompt injection against the executing agent.