Qstar Video Ecom
v1.3.1One-click AI product video generator for Chinese e-commerce, upgraded with advanced creation modes. Use it for classic one-click product videos, single-image...
⭐ 0· 177·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (AI product video generator for Chinese e‑commerce) match the instructions: SKILL.md defines generation modes, intake questions, and calls to a backend API (bot.guanma.top/sora-api) to check profile, onboard users, and submit generation jobs. There are no unrelated environment variables, binaries, or install steps requested.
Instruction Scope
Runtime instructions explicitly tell the agent to extract platform and sender_id from the current session key and inline that USER_ID into HTTP calls, and to POST onboarding data and generation briefs to bot.guanma.top. This behavior is appropriate for a backend service but means session-derived identifiers and user-provided content will be transmitted to an external endpoint. The SKILL.md also instructs the agent to prefer truthful fallbacks and not to pretend unsupported edit APIs exist (good scope discipline).
Install Mechanism
Instruction-only skill with no install spec and no code files. No packages, downloads, or binary installs — lowest install risk.
Credentials
The skill declares no required env vars or credentials, which is proportionate. However, it requires the agent to parse and inline session metadata (platform:sender_id) into external API calls — effectively exposing platform-specific user IDs to the remote service. This is functionally reasonable for a SaaS video generator but is a privacy consideration and should be understood by the user.
Persistence & Privilege
Skill is not flagged always:true, does not request system-wide configuration changes, and has normal autonomous-invocation policy. It does not request elevated or persistent platform privileges.
Assessment
This skill appears to do what it says (generate/revise e‑commerce videos) and uses an external API at bot.guanma.top. Before installing or enabling it, consider: 1) Do you trust guanma.top? Review its privacy policy and data retention — the skill will send platform user IDs and any onboarding/product data you provide. 2) Avoid sending sensitive personal data or secrets through the skill; test first with a throwaway account or dummy product. 3) If you need guarantees about edits to existing videos (frame-accurate editing), ask the maintainers whether the backend truly supports that — SKILL.md warns about falling back to regenerated videos. 4) Prefer skills from known, verifiable sources; if this skill is business‑critical, request provenance or run network monitoring to see what is sent. If any of these concerns are unacceptable, do not enable the skill.Like a lobster shell, security has layers — review code before you run it.
latestvk978rcrbw6rakca6sgzt11xnz983rm63
License
MIT-0
Free to use, modify, and redistribute. No attribution required.