Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Roblox Clip Transformer
v1.0.0Transform raw Roblox gameplay footage into platform-ready promotional content (TikTok, YouTube Shorts, Reels). Auto-edit with smart trimming, aspect ratio co...
⭐ 0· 26·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The code and instructions match the stated purpose (smart trimming, aspect conversion, beat sync, Whisper captions, brand overlays). However the registry metadata claims no required binaries or env vars while SKILL.md and scripts clearly require FFmpeg, Python 3.10+, Whisper, and librosa (and code also uses numpy/scipy). The required tools are coherent with the purpose but the metadata omission is an inconsistency you should be aware of.
Instruction Scope
Runtime instructions and included scripts operate only on local video/audio files and assets (ffmpeg/ffprobe subprocess calls, Whisper model usage, librosa beat detection). They do not call external APIs or require credentials. Two practical scope concerns: (1) Whisper.load_model may download large model weights from the internet when first used (network I/O not called out explicitly), and (2) many FFmpeg filter strings are built by interpolating user-supplied text (title, cta, logo path) into filter arguments without escaping, which can produce malformed filters or unexpected behavior. Neither is inherently malicious but they expand runtime behavior beyond simple local file manipulation.
Install Mechanism
No install spec is provided (instruction-only + bundled scripts), so nothing is automatically downloaded or installed by the registry. That reduces risk, but you must install dependencies manually. The SKILL.md lists pip packages (ffmpeg-python, librosa, openai-whisper) and system FFmpeg; the code also uses numpy/scipy but scipy is not listed. Missing dependency guidance is an engineering gap.
Credentials
The skill requests no environment variables, no credentials, and no config paths. The scripts only operate on files the user provides; there are no unexplained secrets or cloud credentials requested.
Persistence & Privilege
The skill is not always-enabled and does not request elevated or persistent platform privileges. It does not attempt to modify other skills or system-wide agent settings in the provided code.
What to consider before installing
This package appears to implement the advertised Roblox clip editing features, but take these precautions before running it:
- Metadata mismatch: The registry lists no required binaries, but SKILL.md and the scripts require FFmpeg, Python 3.10+, and Python packages (openai-whisper, librosa, ffmpeg-python). The music script also expects numpy and scipy (scipy is not documented). Install dependencies in a controlled environment (virtualenv or container) first.
- Whisper model downloads: Running caption-sync will load Whisper models, which typically download large model files the first time (network access and significant disk + memory usage). Be prepared for long downloads and large files; run in an environment with bandwidth and disk you control.
- Review user-provided text and asset paths: The render script builds FFmpeg filter strings by interpolating title/CTA/logo values into -vf filters. Avoid passing untrusted or complex strings (quotes, newlines) as title/CTA, and review the code if you need to accept arbitrary user input to prevent malformed filters or unexpected FFmpeg behavior.
- Missing/buggy bits: There are small implementation issues (undeclared dependency on scipy, some FFmpeg filter construction might be brittle, and the platform-render.py file appears truncated at the end—there may be a bug in the main output printing block). Test with non-sensitive sample media before using on important files.
- IP/branding: The assets reference the official Roblox logo. Ensure you have the right to use official brand assets and follow Roblox brand guidelines before publishing.
Recommended steps: clone and inspect the scripts locally; run them in an isolated VM/container; install dependencies explicitly; run on disposable sample videos first; monitor for large downloads by Whisper; and patch any input-escaping issues if you plan to feed untrusted text or files into the tool.Like a lobster shell, security has layers — review code before you run it.
latestvk97e02w76vwv97qk490mmyv015843w2w
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
