Video Generator Auto Post
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill matches its video/social-posting purpose, but its posting workflow can target every platform by default, asks for social account tokens, and currently reports successful posts even though uploads are not implemented.
Install only if you are comfortable reviewing and manually running the script. Do not connect valuable social-media accounts until the posting implementation is real, scoped, and confirmed before publishing; use least-privilege test credentials and avoid running referenced scripts that are not included in the package.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
You may be told that a post succeeded even though no upload actually occurred.
Each platform method is presented as posting to a service, but the implementation is a TODO and still returns success, which can make the user or agent believe a public post was completed when it was not.
# TODO: Implement Twitter API v2 upload # Requires: TWITTER_API_KEY, TWITTER_API_SECRET, TWITTER_ACCESS_TOKEN return True
Do not rely on the success summary until real API posting is implemented; the script should return a clear 'not implemented' failure or provide verifiable post URLs.
If real posting APIs are added, a user or agent could accidentally publish the same content to multiple public accounts at once.
A single invocation without explicit platform narrowing selects every supported platform, and the script contains no visible confirmation or dry-run gate before iterating through posting actions.
parser.add_argument('--platforms', default='all' ...)
...
if platforms == 'all':
selected = list(self.platforms.keys())Require explicit platform selection, add a confirmation/dry-run step, and show the exact accounts, caption, hashtags, and destinations before publishing.
Connecting social media tokens can grant the skill authority to act on those accounts.
The skill expects social-media credentials for posting, while the registry metadata declares no required environment variables or primary credential. This is purpose-aligned but under-disclosed.
Configure API keys in `.env`
Use least-privilege tokens, test on non-production accounts first, and ensure the registry metadata clearly declares required credentials and scopes.
Some documented commands may fail or may require obtaining unreviewed files from elsewhere.
SKILL.md references runnable helper scripts and assets that are not present in the provided manifest, so those components were not reviewable in this artifact set.
`scripts/generate-video.py` - Single video generation `scripts/batch-generate.py` - Batch processing `assets/default-workflow.json` - Basic text-to-video workflow
Only run scripts included in the reviewed package; the publisher should either include the referenced files or remove the instructions.