jiege-openclaw-video

高性能视频生成技能包，集成 Sora 和 VEO 模型接口，提供全自动的视频生成、轮询和下载管理。

Security Scan

The skill will run a detached Python worker that reads your OpenClaw config to grab an API key and call an external model endpoint, but its code and documentation don't fully align and it uses your config without declaring that credential — this is concerning and deserves review before install.

Purpose & Capability

The description claims integration with Sora and VEO, but the implementation only calls a VEO-like flow and POSTs to https://maas-openapi.wanjiedata.com. The manifest and SKILL.md do not declare any required credential even though the code reads ~/.openclaw/openclaw.json for an apiKey. The declared purpose (multi-provider video generation) does not match the actual endpoints and credential usage.

Instruction Scope

The runtime instructions and code cause the agent to spawn a detached background Python worker which: (a) reads ~/.openclaw/openclaw.json to extract an apiKey, (b) makes streamed HTTP POST requests to an external API (wanjiedata), (c) aggregates streamed content and blindly opens the first URL found in the response using os.startfile, and (d) writes log and lock files into the skill directory. Reading an agent config and opening arbitrary returned URLs are broader actions than the SKILL.md explicitly documents and can have surprising side effects.

Install Mechanism

This is instruction-only (no install spec). The bundle includes Python scripts and a requirements.txt (requests). No remote downloads or installers are used, which lowers supply-chain risk, but code will be placed on disk and executed by spawning a detached Python process.

Credentials

The skill accesses ~/.openclaw/openclaw.json to extract an apiKey but declares no required environment variables or primary credential. It takes the first provider apiKey it finds (no validation) and uses it to authenticate to a third-party endpoint. This may cause the skill to use a key intended for another service, effectively granting that external host access to your configured provider credentials.

Persistence & Privilege

always:false (normal). However, the skill deliberately launches fully detached background processes (child.unref() / subprocess.Popen detached) that run independently of the agent lifecycle; those processes run with the user's privileges and will continue until completion. This is expected for asynchronous workloads but increases blast radius if the worker does unexpected network activity.

What to consider before installing

Before installing: review the Python scripts yourself (veo_worker.py, video_interface.py, hooks.js). Key points to consider: - The skill reads ~/.openclaw/openclaw.json and uses the first apiKey found to call an external API (wanjiedata). If that file contains keys for other services, those keys could be used unintentionally. Create a dedicated provider/apiKey for this skill or modify the code to use a dedicated env var. - The worker will open any URL returned in the streamed response without validation — a malicious or compromised provider could return a harmful URL. Consider removing/validating the auto-open behavior. - The skill spawns detached background processes that run independently; test it in a controlled environment first. - The README/SKILL.md and manifest claim multi-provider integration (Sora) but code only uses one external endpoint — ask the author to clarify which provider is used and to explicitly declare required credentials. If you cannot audit or modify the code, avoid installing it on systems where your OpenClaw config contains sensitive keys you do not want reused, or run it in an isolated environment.

Skill: jiege-video-skill

作者: 何振杰

功能描述

一个高性能 Veo 视频生成技能，支持通过自然语言一键生成。

适用场景

• 自动化视频创作。
• 无需命令行参数，通过自然语言对话生成视频。

安装说明

1. 使用 openclaw install jiege-video-skill 安装。
2. 确保在 ~/.openclaw/openclaw.json 中配置了有效的 API Key。

使用方法

安装后，直接在聊天窗口输入：

生成视频：[您的提示词]

例如：

生成视频：一只在雨中奔跑的黑豹，电影质感

运行机制

• 拦截指令后，自动调用后台进程生成。
• 任务完成时，会自动在浏览器中弹出结果页面。
• 内置锁机制，防止并发重复任务。

注意事项

• 请确保系统环境已安装 Python。
• 若提示任务阻塞，请确认无残留的 .lock 文件。