Video Generator Auto Post

Generate videos using local AI models (ComfyUI/Stable Video Diffusion) and auto-publish to social media platforms. Supports text-to-video, image-to-video, ba...

Plain-language checklist before installing/using this skill: - Expect to supply social-media API credentials in a .env (Twitter, TikTok, Instagram, LinkedIn, YouTube) even though the registry didn't list them; only install this if you're comfortable providing those keys. - The included auto-post.py only prints stub messages — it does not actually upload to platforms. Do not assume it will post without you implementing or trusting added code that performs uploads. - Several scripts and assets mentioned in SKILL.md are missing from the package (batch-generate.py, generate-video.py, optimize-video.py, many referenced assets). Ask the author for the complete package or treat this as a draft. - SKILL.md is Windows-centric (D: drive, ComfyUI.exe, winget) but registry has no OS restriction. Make sure path recommendations match your OS and that you don’t inadvertently point the tool at system locations you don’t want it to use. - If you plan to use or modify the auto-post script: inspect any code you add for network endpoints and secure handling of credentials; store API keys only in secure locations and use least-privilege tokens where possible. What would increase confidence: a corrected package that (1) declares required env vars in metadata, (2) includes the referenced scripts/assets, and (3) either implements safe, auditable API upload code or clearly documents that posting is a placeholder and how to configure a vetted client library.

Type: OpenClaw Skill Name: video-generator-auto-post Version: 1.1.0 The skill is classified as suspicious because it explicitly sets up the framework for handling sensitive API keys and performing network operations to external social media platforms, even though the core posting functionality in `scripts/auto-post.py` is currently a stub (marked with `TODO`s). The `SKILL.md` instructs users to configure API keys in a `.env` file, which `scripts/auto-post.py` loads. While there is no evidence of immediate malicious intent, data exfiltration, or active vulnerabilities in the provided code, the clear intent and preparation for risky capabilities (handling credentials, external network communication) without full implementation makes it not entirely benign, as future completion could introduce vulnerabilities.