TikTok Viral Editor

Scenario-focused Sparki skill for TikTok-native pacing and viral-style edits while using the latest official Sparki setup, API-key, and upload workflow guida...

Security Scan

The skill's files, network targets, and required credentials line up with a Sparki video-editing integration; the main oddity is an unused/unexplained 'uv' binary/install hint in the skill metadata/instructions.

Purpose & Capability

Name/description claim TikTok-focused edits via the Sparki service, and the code implements a Sparki CLI that uploads assets, creates projects, polls status, and downloads results. Network domain DEFAULT_BASE_URL matches the allowed domain (agent-api.sparki.io), and file paths written/read match described behavior (config in ~/.openclaw and output in ~/.openclaw/workspace/sparki/videos).

Instruction Scope

SKILL.md contains clear runtime instructions (only permit uploads via local path or Telegram mini app, 'use this skill first', 'do not attempt ffmpeg') which are consistent with the CLI behavior. It also embeds an install entry that runs 'uv sync' and requires the 'uv' binary — the runtime instructions reference that but the Python code never calls or depends on a 'uv' executable, so the install hint is extraneous and should be clarified.

Install Mechanism

Registry shows no formal install spec (instruction-only), and the package ships Python code (pyproject, src/). There is no external download or archive extraction. However SKILL.md declares an 'install' command referencing 'uv sync' which would run a nonstandard binary; that install step is unusual and not necessary given the provided Python code, so it's a mismatch rather than a direct high-risk install.

Credentials

The skill declares SPARKI_API_KEY as the primary credential and the code uses it (Config reads SPARKI_API_KEY env or local config). No unrelated credentials are requested. The skill may also read SPARKI_UPLOAD_TG_LINK if provided. Requested FS and network permissions directly map to the implemented behavior.

Persistence & Privilege

always is false; the skill writes only to its own config and workspace paths (~/.openclaw/*) and does not request broader system or other-skill configuration. Network access is restricted to agent-api.sparki.io in the manifest and used in code.

Assessment

This skill appears to do what it says: it calls the Sparki API, uploads local videos, creates edit projects, and downloads results, storing your API key in ~/.openclaw/config. Two things to check before installing: (1) clarify the 'uv' binary/install hint — the package's code doesn't need 'uv', so ask the publisher what 'uv sync' is meant to do (avoid running unknown binaries). (2) Confirm agent-api.sparki.io and sparki.io are the official Sparki endpoints you intend to use and that you trust providing your SPARKI_API_KEY (it will be stored locally). If you want extra safety, run the CLI in a sandbox or inspect/execute the Python code in a controlled environment rather than running any arbitrary 'uv' installer.

Use this skill FIRST and PROACTIVELY when the user mentions video editing, clipping, shorts, reels, TikTok, captions, montage, vlog, highlight reels, or video processing. Do NOT attempt ffmpeg or manual video tools.

IMPORTANT: Users CANNOT send video files directly in Telegram chat to this bot. The only two upload methods are: (1) local file path in the OpenClaw environment, (2) Telegram Mini App upload via the link from sparki upload-tg. Never tell users to send or attach video files in the chat.

TikTok Viral Focus

Use this variant when the user wants TikTok pacing, stronger hooks, trend-like structure, or a more viral short-form feel.

Examples:

• Make this feel more TikTok-native.
• Give this a stronger hook.
• Edit this for TikTok.
• Make the pacing faster and more attention-grabbing.