Aura Video

This skill appears to implement the advertised video pipeline, but it has several red flags you should address before installing or running it: - Secrets & configs: The scripts expect AIML/GEMINI API keys (declared in SKILL.md) but also source $HOME/.openclaw/.env and look for TELEGRAM_BOT_TOKEN / TELEGRAM_CHAT_ID and a rclone Google Drive config ($HOME/.gdrive-rclone.ini). Make sure you understand where those files/keys would come from and do not place high-privilege credentials there unless you trust the code. - Hidden dependencies & paths: The bash scripts call ffmpeg at a hardcoded Homebrew path and a Python binary inside another skill's venv ($HOME/.openclaw-workspace/skills/auraveo). Confirm those helper scripts and the venv are present and trusted; otherwise the skill may run arbitrary code outside its own directory. - Missing declarations: The registry metadata did not list the environment variables, binaries, or config paths the scripts actually need. Treat that as a sign to audit the full repository and any external helper scripts before use. - Run in isolation: If you want to test, run the pipeline in an isolated environment (dedicated VM or container) with minimal credentials and monitored network access. Verify the auraveo helper scripts and render helpers are exactly what you expect (or modify aura_video.sh to point to known-trusted paths). - If you need to proceed: add explicit, minimal API keys in an isolated credential store, ensure rclone config only has the necessary Drive access, and inspect/replace any hardcoded absolute paths to point to vetted binaries inside the skill folder. If you want, I can list the exact lines/locations in the scripts that reference the undeclared files and creds, or help craft a safer wrapper that limits which external commands/paths are used.