Web2Labs Studio

Edit my recording, turn a long video into shorts, generate captions and thumbnails, estimate cost before processing. Upload local files or YouTube/Twitch URL...

This skill appears coherent for controlling the Web2Labs Studio service from your agent. Before installing: (1) Only provide WEB2LABS_API_KEY if you trust web2labs.com; the key will be stored in ~/.openclaw/openclaw.json (the code attempts chmod 600). (2) Be cautious when supplying webhook_url values — the skill will POST job results to whatever callback URL you provide (so do not point that at an untrusted endpoint if you want to keep outputs private). (3) yt-dlp will be executed for URL inputs; ensure you are comfortable with the skill running that binary and writing temporary files. (4) If you want strict budget control, configure WEB2LABS_SPEND_POLICY or the WEB2LABS_AUTO_SPEND_* env vars before use. Overall this skill is internally consistent with its stated purpose; if you need higher assurance, confirm the network domains contacted (baseUrl defaults to https://www.web2labs.com) and review the small set of included npm dependencies in package-lock.json.

Type: OpenClaw Skill Name: web2labs-studio Version: 1.0.1 The OpenClaw Studio skill is designed with strong security controls, explicitly addressing common attack vectors. It prevents credential leakage by stripping authentication headers for non-Web2Labs domains (`src/lib/api-client.mjs`), sanitizes remote filenames to prevent path traversal during downloads (`src/tools/download.mjs`), and uses `execFileAsync` for `yt-dlp` execution with carefully constructed arguments to mitigate shell injection risks (`src/lib/downloader.mjs`). API keys are stored locally with restricted permissions (`~/.openclaw/openclaw.json`, `chmod 600`). The `SKILL.md` instructions guide the AI agent in a safe and cost-aware manner, reinforcing guardrails against misuse. There is no evidence of intentional harmful behavior, obfuscation, or unauthorized data exfiltration.