Build and execute skills.video video generation REST requests from OpenAPI specs. Use when user needs to create, debug, or document video generation calls on...
Security Analysis
medium confidenceThe skill's requirements and instructions are coherent with a video-generation proxy/helper for the skills.video platform; it only needs an API key and common tools, but review local-file usage and a small coding bug before installing.
Name/description, required binaries (python3, curl), and the single required env var (SKILLS_VIDEO_API_KEY) match the skill's stated purpose of building and executing skills.video REST calls. Included helper scripts implement OpenAPI inspection, SSE creation, fallback polling, and error classification — all consistent with the described workflow.
The runtime instructions explicitly tell the agent to load OpenAPI/docs JSON and optional payload files from absolute paths and to POST payloads to open.skills.video. That is appropriate for this skill, but it means the agent (via the scripts) will read any local files you point it at and may transmit their contents to the remote API. Users should avoid passing sensitive local files (secrets, private keys, system config) as payload/openapi inputs.
No install spec is present (instruction-only with included scripts), so nothing is downloaded or executed at install time. Runtime requires only python3 and curl which are reasonable for the scripts provided.
Only one credential (SKILLS_VIDEO_API_KEY) is required and is the declared primary credential — appropriate and proportional for a service client. The scripts do not access other environment variables or unrelated secrets.
Skill is not forced-always (always:false) and does not request system-wide config or write other skills' settings. It runs as a user-invokable skill and uses no privileged persistence mechanisms.
Guidance
This skill appears to be what it claims: a helper for calling skills.video generation endpoints. Before installing or enabling it: (1) Verify you trust the hostname(s) referenced (open.skills.video / skills.video) and the published repository/homepage if you need source-of-truth assurance. (2) Provide SKILLS_VIDEO_API_KEY via secure secret storage (do not hardcode). (3) Be cautious when supplying file paths to commands (openapi.json, docs.json, payload files): the scripts will read those files and may transmit their contents to the remote API. Do not point the scripts at sensitive files. (4) There is a small coding issue observed in inspect_openapi.py (an undefined variable 'pr' used when assigning a field description) and some files in the supplied listing were truncated; consider reviewing the full script sources from the upstream repository or vendor before use and test in a safe environment. (5) If you want additional assurance, review the repository at the declared link or request a full untruncated source review. If any behavior beyond the documented endpoints or unexpected additional env vars is required, treat that as suspicious and do not enable the skill.
Latest Release
v1.0.3
- Added MIT license information and author metadata. - Declared supported operating systems (linux, darwin) and required binaries (python3, curl). - Included links to repository and homepage. - Enhanced OpenClaw environment configuration details and CLI help in metadata. - No logic or workflow changes to the skill instructions.
Popular Skills
Published by @skills-video on ClawHub
