aigc-director

This package appears to be a local AI video studio and largely does what it says, but take these precautions before installing or running it: - Expect to provide many API keys: DeepSeek, DashScope (Aliyun), ByteDance/Seedream (ARK), Volc/JeMeng, Kling (Kuaishou), OpenAI, Google Gemini, etc. The SKILL.md and config.py list these variables. The registry metadata incorrectly lists none — treat that as an omission. - The agent will read aigc-claw/backend/.env and use any API keys there. Do not put high-privilege or unrelated secrets in that file. Prefer creating a minimal .env containing only keys you want this local service to use. - The skill constructs and shares a LAN-accessible frontend URL (it resolves a local IPv4 and suggests sending it). That can expose your machine to other devices on the LAN — only share if you trust your network and the recipients. - The package runs local code (Python backend, Node frontend) and will execute subprocesses (ffmpeg). Only run this code in a controlled environment (VM/container or an isolated machine) if you do not fully trust the source. The source/homepage is unknown in registry metadata — verify the upstream repository and review critical files (tool clients that call external APIs) before running. - If you decide to run it: inspect the tool client modules (aigc-claw/backend/tool/) to confirm which endpoints are called with your API keys, and check for any unexpected network calls or data exfiltration. Consider running with network isolation or with dummy API keys first. If you want to proceed safely, ask for guidance locating and sanitizing the .env, or for a checklist to run the backend/frontend inside a container or VM so secrets and network exposure are controlled.

These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.