Clawprompt

Launch a smart teleprompter with mobile remote control for video recording. Use when the user wants to read scripts while recording video, use a teleprompter...

Security Scan

The skill is a coherent local LAN teleprompter: the files and runtime instructions match the description and there are no undeclared credentials, odd external downloads, or hidden endpoints.

Purpose & Capability

Name/description (teleprompter with mobile remote) align with the included files: a small Node HTTP+WebSocket server, browser UI (index.html) and remote UI (remote.html). Required capabilities (WebSocket, local HTTP) are appropriate.

Instruction Scope

SKILL.md instructs running npm install and node server.js in the scripts directory and to open http://localhost:7870 — this matches the code. The client-side fallback uses an external QR generation service (api.qrserver.com) only if local QR generation fails; otherwise QR images are generated locally by the server. Remote devices can upload arbitrary text and send next/prev commands (intended behavior), so connecting untrusted phones allows them to control or replace displayed text.

Install Mechanism

No install spec in registry; the skill is instruction-only but bundles code. The npm dependencies (qrcode, ws) are reasonable and expected for this functionality; npm install will pull from the public registry (normal). No opaque downloads or extract-from-URL operations are present.

Credentials

No environment variables or credentials are required (PORT is optional). The skill does not request unrelated secrets or config paths.

Persistence & Privilege

The server listens on 0.0.0.0 and advertises a LAN URL based on the machine's IPv4 interface. This is appropriate for a LAN teleprompter but means the service is reachable by other devices on the same network (or beyond if network routing/firewall allows). The skill does not request permanent presence or modify other skills.

Assessment

This skill appears to do exactly what it claims: run a small local web+WebSocket server so a phone can remotely control a teleprompter. Before installing, consider: (1) npm install will fetch dependencies from the public registry (qrcode, ws) — audit if you require stricter sourcing; (2) the server binds to 0.0.0.0 and advertises your LAN IP, so any device on the same network can connect and, if given the QR/URL, control or upload text — avoid using on untrusted/public networks or ensure your firewall restricts access; (3) the browser fallback may contact api.qrserver.com only if local QR generation fails (this transmits the advertised local URL to that service); (4) no credentials are requested and there are no hidden remote endpoints in the code. If you want tighter security, run it with a local firewall rule, a bind-to-localhost edit, or only on a private network; inspect or pin the npm packages if supply-chain risk is a concern.

ClawPrompt 🦞📝 — Smart Teleprompter with Mobile Remote

What It Does

A browser-based teleprompter that runs on your Mac. A second person can use their phone as a remote control to turn pages while the speaker focuses on the camera.

Quick Start

cd {SKILL_DIR}/scripts
npm install --silent
node server.js

Then open http://localhost:7870 on the computer.

How It Works

1. Computer: Open the teleprompter page → paste or type your script → click "开始提词"
2. Phone: Scan the QR code shown on the computer → phone becomes a remote controller
3. Recording: Speaker looks at camera, peripheral vision reads text at top of screen. Another person holds the phone and taps "下一句" to advance.

Controls

• Computer keyboard: Space/↓ = next, ↑ = prev, +/- = font size, ESC = exit
• Phone: Tap "下一句" / "上一句" buttons
• Text upload: From either computer or phone

Integration with ClawCut

If using ClawCut to generate video scripts, the 9-scene script can be pasted directly into ClawPrompt.

Requirements

• Node.js (for WebSocket server)
• Computer and phone on the same WiFi network
• Port 7870 (configurable via PORT env var)