world-as-100-people-video-gen

Create ‘world as 100 people’ verticals: shrink hook, stat morphs, punchline, timed English captions and motion graphics (WeryAI). Use for infographic TikToks...

This package appears to do what it says: generate short videos via WeryAI and, when given local image paths, read the file and upload it to WeryAI's upload endpoint using your WERYAI_API_KEY. Before installing or running it: (1) do not commit your WERYAI_API_KEY to source control; prefer a short‑lived or scoped API key if WeryAI supports that; (2) prefer supplying public https image URLs so no local-file read/upload is necessary; (3) if you must allow local image paths, review scripts/video_gen.js yourself and explicitly consent to local file access — the SKILL.md asks for that, but make sure your agent actually enforces it; (4) verify the API host (api.weryai.com and api-growth-agent.weryai.com) and rotate keys after testing; (5) if you do not want the skill invoked autonomously, disable autonomous invocation in your agent settings or require manual confirmation before runs.

Type: OpenClaw Skill Name: world-as-100-people-video-gen Version: 1.0.1 The skill contains a script `scripts/video_gen.js` that implements functionality to read local files and upload them to a remote endpoint (api-growth-agent.weryai.com). While this is documented in `SKILL.md` and `WERYAI_VIDEO_API.md` as a feature for converting local images to video, it represents a high-risk capability for data exfiltration if the AI agent is manipulated into targeting sensitive files (e.g., SSH keys or configuration files). The script lacks robust server-side or client-side validation to ensure that only intended image files are processed before being sent to the external API.