Security checks across malware telemetry and agentic risk
This skill mostly matches a social video automation tool, but it also contains under-disclosed host-level and credential-handling behavior that users should review carefully before installing.
Install only if you are comfortable granting this skill access to your social publishing accounts, Metricool token, local media library, and some OpenClaw credential/profile files. Review or remove the host-level cleanup/proxy code before running it on your main machine, and run it in an isolated environment with a dedicated config, dedicated workspace directory, and limited API credentials.
for attempt in range(3):
try:
r = subprocess.run(
[HF_NODE, HF_BIN, "render", "-o", output_path,
"--resolution", resolution, "--quality", quality,
"--fps", "30", str(_WORK_DIR)],SCRIPT = os.path.join(os.path.dirname(__file__), 'run_and_notify.py')
def cleanup_chrome():
subprocess.run(['pkill', '-9', '-f', 'Google Chrome'], capture_output=True, timeout=5)
def cleanup_workspace():
ws = os.path.join(os.path.dirname(__file__), '..', get_path("workspace_dir"))pass
# 代理阻断，杀进程重试
if attempt < 2:
subprocess.run(['pkill', '-9', '-f', 'MacPacketTunnel'], capture_output=True, timeout=5)
time.sleep(2)
return """fileExtension": "mp4"
})
r = subprocess.run(["curl", "-s", "-X", "PUT",
f"{api_url}/v2/media/s3/upload-transactions?{base_q}",
"-H", "Content-Type: application/json", "-H", auth_h,
"-d", s3_start_body],if any(p["network"] == "instagram" for p in _providers):
_body["instagramData"] = {"autoPublish": True}
post_body = json_lib.dumps(_body)
r4 = subprocess.run(["curl", "-s", "-w", "\n%{http_code}",
"-X", "POST", f"{api_url}/v2/scheduler/posts?{base_q}",
"-H", "Content-Type: application/json", "-H", auth_h,
"-d", post_body],cdn_url = ""
if upload_type == "SIMPLE":
r2 = subprocess.run(["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}",
"-X", "PUT", "-T", video_path,
"-H", "Content-Type: video/mp4",
"-H", f"x-amz-checksum-sha256: {file_hash_b64}","parts": completed_parts,
}
}
r_comp = subprocess.run(["curl", "-s", "-w", "\n%{http_code}",
"-X", "PATCH",
f"{api_url}/v2/media/s3/upload-transactions?{base_q}",
"-H", "Content-Type: application/json", "-H", auth_h,# 没有CDN URL时用raw S3 URL
s3_url = f"https://{bucket}.s3.eu-west-1.amazonaws.com/{key}"
encoded_url = quote(s3_url, safe="")
r3 = subprocess.run(["curl", "-s", "-w", "\n%{http_code}",
f"{api_url}/actions/normalize/image/url?url={encoded_url}&{base_q}",
"-H", auth_h], capture_output=True, text=True, timeout=30)
parts3 = r3.stdout.strip().rsplit("\n", 1)with open(tmp, "wb") as f:
f.write(part_data)
# 用-D捕获响应头获取ETag
r_p = subprocess.run(["curl", "-s", "-D", "/tmp/mc_hdr" + str(pn),
"-o", "/dev/null", "-w", "%{http_code}",
"-X", "PUT", "-T", tmp,
"-H", "Content-Type: video/mp4",65/65 vendors flagged this skill as clean.