Video Processor
AdvisoryAudited by VirusTotal on Apr 17, 2026.
Overview
Type: OpenClaw Skill Name: xiaoming-video-processor Version: 1.1.0 The skill bundle contains standard documentation and metadata for a video processing tool. The instructions in SKILL.md and README.md are consistent with the stated purpose of video conversion, compression, and editing, and do not contain any signs of prompt injection, malicious commands, or data exfiltration attempts.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A future install could execute a different version of the installer than the one implied by the reviewed artifacts.
The README uses a user-directed install command with a moving '@latest' package version. This is common setup documentation, but it is not pinned to a reviewed version.
npx clawhub@latest install video-processor
Install only from a trusted ClawHub/npm source, and pin or verify versions when possible.
Users may need local tools that are not visible in the registry requirements, and should be aware that curl can support network operations if used by external commands.
The included metadata declares curl and ffmpeg and shows version 1.0.0, while the registry metadata says version 1.1.0 and no required binaries. ffmpeg is expected for video processing, but the mismatch and curl dependency are disclosure gaps rather than evidence of malicious use.
"version":"1.0.0","requires":{"bins":["curl","ffmpeg"]}Treat ffmpeg/curl as required local dependencies, and verify what the external video CLI does before processing private videos.