cutmv

Video processing tool using FFmpeg for cutting, format conversion, compression, frame/audio extraction, watermarking, and subtitle addition.

Security Scan

The skill's functionality (FFmpeg-based video processing) is coherent, but there are a few mismatches and a small unsafe coding pattern (use of eval) that you should review before installing.

Purpose & Capability

The skill's name, README, SKILL.md, and code all describe an FFmpeg-based video tool, which is coherent. However the registry metadata claims no required binaries/configs while SKILL.md and skill.py clearly require FFmpeg and ffprobe on PATH — the declared requirements are incomplete. The source/homepage is 'unknown' even though README references a GitHub repo URL, so provenance is unclear.

Instruction Scope

SKILL.md stays within the expected scope (running ffmpeg/ffprobe via skill.py). It does not instruct reading unrelated system files or using external endpoints. The runtime uses subprocess with argument lists (no shell=True), which is safer. However skill.py uses eval(...) when parsing ffprobe's r_frame_rate which is an unsafe pattern if ffprobe output can be tampered with or if untrusted metadata is processed.

Install Mechanism

No install spec (instruction-only plus a Python file) — lowest install risk. The skill relies on a system FFmpeg/ffprobe installation as documented in SKILL.md rather than pulling arbitrary code from the network during install.

Credentials

The skill declares no required environment variables or credentials, which is appropriate. But it fails to declare the required system binaries (ffmpeg/ffprobe) in the registry metadata — an omission that underreports the actual external dependency. There are no requests for unrelated secrets or config paths.

Persistence & Privilege

The skill does not request persistent privileges (always:false) and does not modify other skills or system settings. Autonomous invocation is allowed (default) but that's normal for skills and not combined with other high-risk factors here.

What to consider before installing

This skill appears to do what it claims (video ops via FFmpeg), but check these before installing: - Verify FFmpeg/ffprobe are required: SKILL.md and code require ffmpeg on PATH even though the registry metadata omits it. Ensure you have FFmpeg installed from a trusted source. - Review the code locally (skill.py) before running. There is use of eval() when parsing ffprobe output — that is a potential code-injection risk if input metadata is malicious. If you will process untrusted files, either sandbox execution or patch the code to avoid eval (e.g., parse the fraction safely). - Confirm provenance: source/homepage is unknown. Prefer skills with a verifiable repository or maintainer identity. The README references a GitHub repo and authors; validate those links and signatures if possible. - Run the tests and the CLI in a safe environment (sandbox or VM) to observe behavior: python skill.py test and sample operations on harmless media files. - If you need tighter security, request the author to (1) update registry metadata to list ffmpeg/ffprobe as required binaries, (2) remove eval and handle ffprobe output safely, and (3) provide a canonical source/repo for review. Given these issues, proceed with caution. The problems look like sloppy metadata and one unsafe code pattern rather than clear malicious intent, hence 'suspicious' with medium confidence.

SKILL.md - cutmv Video Tool

Skill Name

cutmv-video-tool

Description

A video processing skill for OpenClaw that leverages FFmpeg to perform video/audio cutting, format conversion, and compression. Perfect for handling video files for messaging apps with file size limits.

Capabilities

• Video Cutting: Split video/audio by time range
• Format Conversion: Convert between video/audio formats (mp4, avi, mp3, wav, etc.)
• Video Compression: Compress videos with adjustable bitrate
• Frame Extraction: Extract frames from videos at specified intervals
• Audio Extraction: Extract audio track from video
• Audio Replacement: Replace or mix audio in video
• Text Watermark: Add text overlay on video (requires freetype)
• Subtitle: Add .srt/.ass subtitle files to video

Use Cases

1. Compress videos to send via WeChat/Lark/Telegram (16MB limit)
2. Extract screenshots from videos for analysis
3. Convert video formats for different platforms
4. Cut specific segments from long videos

Requirements

System Requirements

• FFmpeg installed and available in PATH
• Python 3.7+

Python Dependencies

• None (uses subprocess to call ffmpeg)

Installation

1. Ensure FFmpeg is installed on your system:

   • macOS: brew install ffmpeg
   • Ubuntu: sudo apt install ffmpeg
   • Windows: Download from ffmpeg.org or winget install ffmpeg

2. Place the skill files in your workspace:

   ~/openclaw-workspace/skills/cutmv-video-tool/
   ├── SKILL.md
   ├── skill.py
   ├── README.md
   └── README-CN.md
   

Usage

Python API

from skill import VideoTool

tool = VideoTool()

# Compress video for messaging
tool.compress("input.mp4", "output.mp4", bitrate="1000k")

# Cut video segment
tool.cut("input.mp4", "clip.mp4", start_time=30, end_time=90)

# Convert format
tool.convert("input.mp4", "output.avi", "avi")

# Extract frames every 10 seconds
tool.extract_frames("input.mp4", "./frames/", interval=10)

CLI Usage

# Compress video
python skill.py compress input.mp4 output.mp4 1000k

# Cut video
python skill.py cut input.mp4 clip.mp4 0 60

# Convert format
python skill.py convert input.mp4 output.mp3 mp3

Configuration

No additional configuration required. The skill uses system FFmpeg installation.

Testing

Run the built-in tests:

python skill.py test

License

MIT License

Author

• Isaac (@QiaoTuCodes)

Acknowledgments

• OpenClaw team for the platform
• FFmpeg team for media processing tools

---

Author Identity: yanyan@3c3d77679723a2fe95d3faf9d2c2e5a65559acbc97fef1ef37783514a80ae453