YouTube Shorts 자동 생성

AI/DevOps 유튜브 숏츠 자동 생성. 트렌드 수집 → 스크립트 → 이미지 → Veo 영상 → TTS 나레이션 → Remotion 합성 → YouTube 업로드

This skill asks the agent to clone and run a GitHub repository and to install packages, then run commands that can upload videos. Before installing or running it: 1) Inspect the repository (https://github.com/kangjjang/youtube-shorts-skill.git) and review scripts/setup.sh and requirements.txt for unexpected behavior. 2) Confirm where YouTube upload credentials and any Veo (or other paid service) API keys are configured — do not provide your YouTube OAuth tokens unless you trust and have inspected the code. 3) Consider running the code in an isolated sandbox or ephemeral VM first to observe network calls and file writes. 4) If you only want the instruction logic and not remote code execution, ask the publisher to include the scripts in the skill bundle or to declare all required credentials and explain upload flow. 5) If you cannot audit the repo, do not supply GEMINI_API_KEY or other secrets to an unreviewed skill.

Type: OpenClaw Skill Name: youtube-shorts Version: 2.0.1 The skill is classified as suspicious due to its broad requested permissions and the instruction to fetch and execute unverified external code. `SKILL.md` explicitly requests `Bash`, `Read`, `Write`, and `exec` tools, granting extensive control. Crucially, it instructs the agent to `git clone https://github.com/kangjjang/youtube-shorts-skill.git` and then execute `bash scripts/setup.sh` from the cloned repository. This constitutes a significant supply chain vulnerability, as the content of the external repository and its setup script are not provided for analysis and could contain malicious payloads. Additionally, `pip install -r requirements.txt` introduces further supply chain risk via Python packages. The skill also requires `GEMINI_API_KEY`, which, combined with the broad permissions, could be vulnerable to exfiltration by the external code.