Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Nm Scry Media Composition

v1.0.0

Combine media assets (GIFs, videos) into composite tutorials with vertical/horizontal

0· 100·1 current·1 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for athola/nm-scry-media-composition.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Nm Scry Media Composition" (athola/nm-scry-media-composition) from ClawHub.
Skill page: https://clawhub.ai/athola/nm-scry-media-composition
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Config paths to check: night-market.scry:gif-generation
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install athola/nm-scry-media-composition

ClawHub CLI

Package manager switcher

npx clawhub@latest install nm-scry-media-composition
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (combine GIFs/videos into composites) matches the instructions (parse manifest, validate files, run FFmpeg). However, the SKILL.md expects command-line tools (ffmpeg, yq, bash) even though the skill metadata lists no required binaries — that's an inconsistency and should be declared.
!
Instruction Scope
The runtime instructions will parse user-provided manifest files and execute commands listed under components[].requires and full shell ffmpeg/yq commands. That means a manifest can cause arbitrary shell commands to run (e.g., 'requires' entries), so the agent executing this skill could run untrusted commands unless manifests are strictly validated or sandboxed.
Install Mechanism
This is an instruction-only skill with no install spec or embedded code, which minimizes installer risk. No downloads or extraction steps are present.
Credentials
No environment variables or credentials are requested (good). The skill does declare a required config path (night-market.scry:gif-generation) which is plausible for integration with the parent plugin, but it should justify that access in documentation. The lack of declared required binaries (ffmpeg, yq) is a proportionality/accuracy issue.
Persistence & Privilege
always:false and no special privileges requested. The skill does not request persistent presence or system-wide config changes.
What to consider before installing
This skill appears to do what it claims (combine media with FFmpeg), but be cautious: the manifest format includes a components[].requires field and the instructions run shell commands and external tools (ffmpeg, yq). Before running this skill, verify manifests come from trusted sources and review any 'requires' commands. Ensure ffmpeg and yq are installed in a controlled environment (or run the skill in a sandbox/container). Ask the author to: (1) declare required binaries in metadata, (2) limit or sanitize manifest 'requires' execution, or (3) document safe manifest validation rules. If you cannot trust manifests, do not run compositions that will execute them.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🦞 Clawdis
Confignight-market.scry:gif-generation
latestvk971jh1ga32mr6f9zh7t8x6wyh857bjd
100downloads
0stars
1versions
Updated 6d ago
v1.0.0
MIT-0

Night Market Skill — ported from claude-night-market/scry. For the full experience with agents, hooks, and commands, install the Claude Code plugin.

Table of Contents

Media Composition Skill

Combine multiple media assets (GIFs, videos, images) into composite outputs for detailed tutorials and documentation.

When To Use

  • Combining multiple media outputs into compositions
  • Creating composite demos from terminal and browser recordings

When NOT To Use

  • Single-format output that does not need composition
  • Simple terminal recordings - use scry:vhs-recording directly

Overview

This skill orchestrates the combination of separately generated media assets into unified outputs. It reads manifest files that define components and their composition rules, validates all inputs exist, and executes FFmpeg commands to produce the final composite media.

Required TodoWrite Items

- Parse composition manifest file
- Validate all component outputs exist
- Determine composition layout and parameters
- Execute FFmpeg composition command
- Verify combined output file created
- Report composition metrics (file size, dimensions)

Verification: Run the command with --help flag to verify availability.

Manifest Format

Manifests define the components to combine and how to arrange them:

# Example manifest: tutorials/mcp.manifest.yaml
name: mcp
title: "MCP Server Integration"
components:
  - type: tape
    source: mcp.tape
    output: assets/gifs/mcp-terminal.gif
  - type: playwright
    source: browser/mcp-browser.spec.ts
    output: assets/gifs/mcp-browser.gif
    requires:
      - "skrills serve"
combine:
  output: assets/gifs/mcp-combined.gif
  layout: vertical
  options:
    padding: 10
    background: "#1a1a2e"

Verification: Run the command with --help flag to verify availability.

Manifest Schema

FieldTypeRequiredDescription
namestringYesIdentifier for the composition
titlestringNoHuman-readable title
componentsarrayYesList of media components to combine
components[].typestringYesSource type: tape, playwright, static
components[].sourcestringYesPath to source file
components[].outputstringYesPath to generated output
components[].requiresarrayNoCommands to run before generation
combine.outputstringYesPath for combined output
combine.layoutstringYesLayout mode (see table below)
combine.optionsobjectNoLayout-specific options

Step-by-Step Process

1. Parse Manifest File

# Read and validate manifest structure
yq eval '.' manifest.yaml

# Extract component outputs
yq eval '.components[].output' manifest.yaml

Verification: Run the command with --help flag to verify availability.

2. Validate Component Outputs

# Check all required files exist
for output in $(yq eval '.components[].output' manifest.yaml); do
  if [[ ! -f "$output" ]]; then
    echo "ERROR: Missing component: $output"
    exit 1
  fi
done

Verification: Run the command with --help flag to verify availability.

3. Execute FFmpeg Composition

Based on the layout specified in the manifest, execute the appropriate FFmpeg command.

4. Verify Combined Output

# Verify output exists and has content
if [[ -f "$output" && -s "$output" ]]; then
  echo "Composition successful: $output"
  ls -lh "$output"
else
  echo "ERROR: Composition failed"
  exit 1
fi

Verification: Run the command with --help flag to verify availability.

FFmpeg Composition Commands

Vertical Stacking

Stack GIFs/videos top to bottom:

ffmpeg -i top.gif -i bottom.gif \
  -filter_complex "[0:v][1:v]vstack=inputs=2" \
  -y output.gif

Verification: Run the command with --help flag to verify availability.

With padding between:

ffmpeg -i top.gif -i bottom.gif \
  -filter_complex "[0:v]pad=iw:ih+10:0:0:color=black[top];[top][1:v]vstack=inputs=2" \
  -y output.gif

Verification: Run the command with --help flag to verify availability.

Horizontal Stacking

Stack GIFs/videos side by side:

ffmpeg -i left.gif -i right.gif \
  -filter_complex "[0:v][1:v]hstack=inputs=2" \
  -y output.gif

Verification: Run the command with --help flag to verify availability.

Sequential Concatenation

Play GIFs/videos one after another:

# Create concat list file
cat > concat_list.txt << EOF
file 'first.gif'
file 'second.gif'
file 'third.gif'
EOF

# Concatenate
ffmpeg -f concat -safe 0 -i concat_list.txt \
  -y output.gif

Verification: Run the command with --help flag to verify availability.

Grid Layout (2x2)

ffmpeg -i tl.gif -i tr.gif -i bl.gif -i br.gif \
  -filter_complex "[0:v][1:v]hstack=inputs=2[top];[2:v][3:v]hstack=inputs=2[bottom];[top][bottom]vstack=inputs=2" \
  -y output.gif

Verification: Run the command with --help flag to verify availability.

With Background Color

ffmpeg -i top.gif -i bottom.gif \
  -filter_complex "color=c=#1a1a2e:s=800x600[bg];[bg][0:v]overlay=0:0[tmp];[tmp][1:v]overlay=0:300" \
  -y output.gif

Verification: Run the command with --help flag to verify availability.

Layout Options

LayoutDescriptionOptions
verticalStack top to bottompadding, background, align
horizontalStack left to rightpadding, background, align
sequentialPlay in ordertransition, duration
gridN x M grid arrangementrows, cols, padding
overlayLayer on top of each otherposition, opacity
pipPicture-in-picturecorner, scale, margin

Layout Option Details

OptionTypeDefaultDescription
paddingint0Pixels between components
backgroundstring"black"Background color (hex or name)
alignstring"center"Alignment: left, center, right
transitionstring"none"Transition type: fade, wipe, none
scalefloat0.25Scale factor for PiP
cornerstring"br"PiP corner: tl, tr, bl, br

Example Compositions

Terminal + Browser Tutorial

name: plugin-demo
components:
  - type: tape
    source: demo.tape
    output: terminal.gif
  - type: playwright
    source: browser.spec.ts
    output: browser.gif
combine:
  output: demo-combined.gif
  layout: vertical
  options:
    padding: 5
    background: "#0d1117"

Verification: Run the command with --help flag to verify availability.

Side-by-Side Comparison

name: before-after
components:
  - type: static
    source: before.gif
    output: before.gif
  - type: static
    source: after.gif
    output: after.gif
combine:
  output: comparison.gif
  layout: horizontal
  options:
    padding: 10

Verification: Run the command with --help flag to verify availability.

Picture-in-Picture

name: pip-demo
components:
  - type: tape
    source: main.tape
    output: main.gif
  - type: playwright
    source: overlay.spec.ts
    output: overlay.gif
combine:
  output: pip-demo.gif
  layout: pip
  options:
    corner: br
    scale: 0.3
    margin: 20

Verification: Run the command with --help flag to verify availability.

Exit Criteria

  • Manifest file parsed successfully
  • All component outputs validated as existing
  • FFmpeg composition command executed without errors
  • Combined output file exists and has non-zero size
  • Output dimensions and duration logged
  • Temporary files cleaned up

Troubleshooting

Common Issues

Command not found Ensure all dependencies are installed and in PATH

Permission errors Check file permissions and run with appropriate privileges

Unexpected behavior Enable verbose logging with --verbose flag

Comments

Loading comments...