Test Skill 3
v1.0.3Headless creative production studio for AI agents. Generate images, edit photos, create videos, produce voiceover/music/SFX, and assemble polished output via...
⭐ 0· 70·0 current·0 all-time
by@cohnen
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill claims to generate images, video, and audio and includes many provider-specific scripts and docs. Requiring FREEPIK_API_KEY as the primary credential is coherent because Freepik is advertised as a full-capability provider. Optional provider keys (FAL, GOOGLE, OPENROUTER, ELEVENLABS) are declared and used for routing, which fits the described multi-provider design.
Instruction Scope
SKILL.md and README explicitly instruct running the bundled bash/python/node scripts which perform network calls to external provider APIs, write output files (public/, creative-output/, .creative-tasks.jsonl), and track async tasks. The instructions do not ask the agent to read unrelated system files or exfiltrate arbitrary data, but they do grant broad discretion to run many scripts that will execute external HTTP calls. The skill exposes a `--dry-run` flag which helps preview actions.
Install Mechanism
There is no download/install spec; code files are bundled in the skill and nothing in the manifest pulls arbitrary archives from unknown URLs. That reduces supply-chain risk. The skill will rely on local binaries (bash, curl, jq, node, ffmpeg, python) but does not perform external installs during skill install.
Credentials
Only FREEPIK_API_KEY is required; other provider keys are optional. The requested environment variables correspond to the providers the skill claims to use (Freepik, fal.ai, Google Gemini, OpenRouter, ElevenLabs). There are no unrelated or unexpected credential requests (no cloud admin keys, no SSH keys, no database passwords).
Persistence & Privilege
The skill is not marked always:true and does not claim to modify other skills or system-wide settings. It writes task logs and output files into the working/project directories (normal for a CLI tool). Autonomous invocation is allowed (platform default) but is not combined with other high-risk flags.
Assessment
This skill appears to be what it says: a CLI-based creative studio that calls external provider APIs. Before installing or running it: 1) Review the bundled scripts (scripts/*.sh and scripts/python/*) yourself or in an isolated environment — they will execute network calls and write files locally. 2) Only provide the minimal API keys you need (FREEPIK_API_KEY is required; provide other keys only if you want those providers). 3) Note minor inconsistencies: README/SKILL.md reference Node.js, ffmpeg, and Python but the registry only declared curl/jq as required binaries — ensure your environment meets the runtime requirements. 4) Use the provided --dry-run options and run initial commands in a sandbox or non-production machine. 5) Verify licensing/terms for generated assets (Freepik/third-party models) before publishing produced media. If you want higher assurance, ask the publisher for a brief security summary or a smaller test subset of scripts to audit.Like a lobster shell, security has layers — review code before you run it.
audiovk976b3a9fw6cqmh6yep4j8zx8n83mj17creativevk976b3a9fw6cqmh6yep4j8zx8n83mj17imagevk976b3a9fw6cqmh6yep4j8zx8n83mj17latestvk976np9xnem5974tm84mk67zjs83nw7hproductionvk976b3a9fw6cqmh6yep4j8zx8n83mj17remotionvk976b3a9fw6cqmh6yep4j8zx8n83mj17videovk976b3a9fw6cqmh6yep4j8zx8n83mj17
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
Any bincurl, jq
EnvFREEPIK_API_KEY
Primary envFREEPIK_API_KEY