Security checks across malware telemetry and agentic risk
This skill is a disclosed cinematic website-building toolkit; its network, shell, file, and credential use are mostly optional, user-initiated, and aligned with that purpose.
Install only if you want an agent to create or modify cinematic website files and run local Node/npm tooling. Use fal.ai features only with a key you are willing to spend from, keep .env.local out of git, and self-host CDN assets if third-party browser requests are not acceptable. Review troubleshooting reset commands before running them because they can remove dependency/cache files and overwrite template files.
**Verify installation:** ```bash ls -la ~/.openclaw/workspace/skills/cinematic-scroll-skill/ # Should show: SKILL.md, examples/, templates/, references/, .git/ ```
1. Download this repository as a ZIP file (or clone it) 2. Open Claude Desktop → Settings → Capabilities → Skills 3. Click **"Upload skill"** 4. Drag the `cinematic-scroll-skill` folder into the upload dialog 5. Confirm **Verification:**
2. Test the generation route (replace values with your chapter):
```bash
curl -X POST http://localhost:3000/api/generate-edition-asset \
-H "Content-Type: application/json" \
-d '{
"chapterId": "prologue",# (Next.js only reads .env.local at startup) npm run dev # 3. Test with curl (bypass the app to isolate the issue) # ⚠️ CREDENTIAL SAFETY: this reads the key from the $FAL_KEY env var — do NOT paste # the literal key on the command line (it lands in your shell history and process # list). Run in a private shell, don't share the command or its output/logs (the
**Why:** A 4K uncompressed texture is tens of megabytes of VRAM and a slow decode; an un-compressed glTF mesh balloons both download and parse time. Both stall first paint and pressure GPU memory until layers fall back to CPU rasterization. **Replacement:** Cap textures at 2K unless there is a named reason to go higher, use compressed formats (KTX2 / Basis) where supported, and compress geometry with Draco / meshopt. Budget and pipeline live in `ASSETS-3D.md` and `references/3d-stack.md`. ### 5.6 Never force VR locomotion or move the user without consent **Why:** Moving the camera (the user's head) in VR while they stand still is the classic trigger for simulator sickness. Forced acceleration, smooth strafing, or camera shake in an immersive session can make people physically ill. **Replacement:** Default to teleport / snap-turn comfort locomotion, keep a stable horizon, and never translate the user without an explicit input. The 2D page must be complete without XR; XR is a session the user chooses to enter. See `references/webxr.md` for comfort and safety rules.
"env"
],
"security": {
"note": "All sensitive capabilities are optional and user-initiated. FAL_KEY is a billable secret — store it in a gitignored .env.local or a secret manager, never in source or version control. Audit mode uses the agent's own browser/fetch access to analyze a user-supplied URL (not a local headless binary); the request may trigger analytics or side effects on the target — only audit sites you own or are authorized to test. Mode A output pages load GSAP + ScrollTrigger and three.js from cdn.jsdelivr.net, the three.js Draco decoder and @google/model-viewer from unpkg.com, and Google Fonts from fonts.googleapis.com / fonts.gstatic.com (SRI-pinned where the format allows — ES-module import maps cannot carry SRI) — self-host these if your deployment policy requires it. See manifest.md → Security & Privacy and audit-mode.md.",
"secrets": [
"FAL_KEY",
"GENERATE_API_SECRET"if (unauthorized) return unauthorized;
if (!process.env.FAL_KEY) {
console.error('[generate-edition-asset] FAL_KEY not set — add it to .env.local');
return NextResponse.json({ error: 'Image generation not configured.' }, { status: 503 });
}const MODEL_ID = flags.model ?? env.FAL_IMAGE_MODEL ?? 'fal-ai/flux-2-pro';
if (!FAL_KEY && !flags.dryRun) {
console.error('\n[generate-chapter-assets] FAL_KEY missing. Set it in .env.local or your shell.\n');
exit(1);
}65/65 vendors flagged this skill as clean.