Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Anime Drama
v1.0.0将小说原文自动转换为动漫短剧。用户输入故事文本，系统自动完成：分镜脚本生成 → 文生图（RH AI应用）→ 图生视频（RH AI应用）→ ffmpeg合并成片。支持竖屏9:16短视频输出。
⭐ 0· 124·0 current·0 all-time
by@ricksf
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
Name/description align with required binaries (python3, curl, ffmpeg) and the RUNNINGHUB integration. The script and docs consistently implement story→image→video→ffmpeg pipeline and declare dependency on a 'runninghub' helper.
Instruction Scope
SKILL.md and the script stay within the stated purpose, but the implementation constructs shell command strings that embed user story/prompt text (enhanced_prompt) and then executes them via subprocess.run(..., shell=True). This allows command injection if the story or prompts contain shell metacharacters. The script also assumes another skill's script exists at ~/.openclaw/workspace/skills/runninghub/scripts/runninghub_app.py and will call it with the API key.
Install Mechanism
No automated install spec (instruction-only + shipped script), so nothing gets implicitly downloaded/installed by the platform. References include manual download of a static ffmpeg binary from johnvansickle.com (documented, not automated) — verify any manual binary downloads before running.
Credentials
Only RUNNINGHUB_API_KEY (primaryEnv) and optional RH_IMAGE_APP_ID / RH_VIDEO_APP_ID are used; these are appropriate for the RunningHub API calls. The script posts images to https://www.runninghub.cn which matches the declared integration.
Persistence & Privilege
always:false and no attempt to change other skills/config. The skill writes workspace files under the user's home directory (anime-drama-workspace), which is expected for generated artifacts but means you should run under a non-privileged account or sandbox.
What to consider before installing
This skill appears to do what it says, but the supplied Python script constructs shell commands that include text from your story and executes them with shell=True — this creates a command-injection vulnerability if any input is untrusted. Recommendations before installing/using: 1) Review runninghub_app.py (the script it invokes) and ensure it's trusted. 2) Run the pipeline in an isolated, non-privileged environment (container or VM). 3) Do not feed untrusted text into the pipeline; sanitize or escape prompts (use shlex.quote or subprocess.run with argument lists instead of shell=True). 4) Limit/rotate the RUNNINGHUB_API_KEY and consider scoping it to a test account. 5) Verify any manually downloaded ffmpeg binary before use. If you cannot audit or fix the subprocess usage, treat the skill as untrusted and avoid running it on sensitive hosts or with sensitive credentials.Like a lobster shell, security has layers — review code before you run it.
latestvk97ee8aqc5gejg89p0r8pn6hgx83bnyj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
Binspython3, curl, ffmpeg
Primary envRUNNINGHUB_API_KEY