RoughCut

PassAudited by ClawScan on May 1, 2026.

Overview

RoughCut appears to be a coherent local video-processing skill, with noteworthy but disclosed reliance on a local RoughCut script and optional Gemini API access.

Before installing, confirm that the RoughCut repository path is trusted, keep output_root in a location you control, treat direct download links such as pre-signed URLs as sensitive, and only provide GEMINI_API_KEY if you intentionally enable fluff removal.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI05: Unexpected Code Execution

What this means

The skill can run local processing commands when invoked, so an incorrect repo_root or modified script could affect local files or run unintended code.

Why it was flagged

The main workflow tells the agent to run a local shell script against a user-selected video and output directory.

Skill content

bash "$REPO_ROOT/scripts/openclaw/roughcut.sh" \
  --video "$VIDEO_ABS_PATH" \
  --out "$OUTPUT_ROOT"

Recommendation

Use only a trusted RoughCut checkout, inspect the script before first use, and run it only with an explicit user-approved video path or URL.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The behavior depends on whatever code exists in the configured local repository.

Why it was flagged

The skill depends on an external/local repository for the actual runner rather than bundling the reviewed script in the artifact.

Skill content

Confirm RoughCut repo is present on the same Mac.
   - Repo: https://github.com/samerGMTM22/OpenClaw-RoughCut

Recommendation

Pin or verify the RoughCut repository version and ensure repo_root points to the intended directory.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Using fluff removal may consume the user's Gemini quota or expose derived processing data to the configured Gemini workflow.

Why it was flagged

The optional fluff-removal path uses a Gemini API credential, which is disclosed and purpose-aligned but still grants access to a provider account or billing context.

Skill content

If the user enables fluff removal, ensure `GEMINI_API_KEY` is set in the environment that will run RoughCut.

Recommendation

Use a restricted API key if possible, provide it through environment/config mechanisms rather than casual chat, and enable fluff removal only when needed.