Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Huo15 Comic Script

v0.1.0

主题一句话 → 分幕分镜剧本 JSON(国风/仙侠/宫斗/江湖)。输出 script.json 含 characters、scenes、dialogue、camera、mood。触发词:生成剧本、漫剧剧本、分镜脚本、漫剧script。

0· 63·0 current·0 all-time
byJob Zhao@zhaobod1

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for zhaobod1/huo15-comic-script.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Huo15 Comic Script" (zhaobod1/huo15-comic-script) from ClawHub.
Skill page: https://clawhub.ai/zhaobod1/huo15-comic-script
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install huo15-comic-script

ClawHub CLI

Package manager switcher

npx clawhub@latest install huo15-comic-script
Security Scan
Capability signals
CryptoCan make purchasesRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's name/description promise structured script.json output. The code supports that, but also bundles a shared library (ark_api.py, config) that wraps external media-generation APIs (Volcengine 'Ark', Kling, Suno) and pricing/cost logic. Those media capabilities could be reasonable for a full pipeline, but the skill metadata declares no required environment variables or credentials even though the code expects ARK_API_KEY (and the CLI fallback uses the Anthropic SDK which typically requires ANTHROPIC_API_KEY). This is an incoherence between declared purpose/requirements and included capabilities.
Instruction Scope
SKILL.md instructs producing script.json (agent mode can directly write JSON). The included CLI fallback (scripts/script_gen.py) uses the Anthropic SDK to generate JSON when run, and validation/writing of files occurs. The SKILL.md does not instruct calling Ark/Kling/Suno endpoints, and the script_gen entrypoint does not invoke ark_api.py. Still, the repository includes code that can call external services and persist checkpoints/cost files; a user running the CLI or other components can trigger network calls and file writes not described in the high-level README.
Install Mechanism
No install spec or remote downloads are present — this is an instruction-plus-code bundle with no installer. That minimizes install-time risk (nothing is fetched or executed automatically during install).
!
Credentials
Skill metadata lists no required environment variables, but the code enforces/uses credentials: ArkClient raises if ARK_API_KEY is missing; script_gen's Anthropic-based fallback requires the Anthropic SDK and likely ANTHROPIC_API_KEY. The shared config also references third-party endpoints (klingai, sunoapi). These credential requirements are not declared in the skill metadata and are broader than the simple 'script generator' description suggests.
Persistence & Privilege
The skill does not request elevated privileges or always:true. The code writes project-local files (.checkpoint.json and .cost.json) and output script.json into the user-specified output directory; this is expected for a generation pipeline and does not modify system-wide or other-skill configuration.
What to consider before installing
This skill will produce script.json as advertised, but the bundled code includes clients for external media services (Volcengine/Ark, Kling, Suno) and an Anthropic fallback. Those clients require API keys (e.g., ARK_API_KEY, ANTHROPIC_API_KEY) that are not declared in the skill metadata. If you only use the agent to write JSON (the recommended mode in SKILL.md), the shared network clients may not be invoked. If you run the included Python CLI, be aware it may attempt network calls, will write .checkpoint.json and .cost.json in the project/output directory, and may raise errors if API keys are missing. Before installing or running: (1) review the code you plan to execute, (2) avoid providing unrelated credentials, (3) run CLI commands in an isolated environment if you plan to allow network access, and (4) add only the specific API keys you trust and need (principle of least privilege). If you want a simple script-only skill with no external calls, prefer using the agent-mode (direct JSON output) and avoid running the CLI fallback.

Like a lobster shell, security has layers — review code before you run it.

latestvk9794vnjj0vtbtrnvxvnhyphcs85f36e
63downloads
0stars
1versions
Updated 4d ago
v0.1.0
MIT-0

火15 漫剧-剧本分镜 Skill

主题 → 结构化 script.json,后续所有 skill 以此为输入。


输入

python scripts/script_gen.py \
  --theme "少年剑仙三年归来" \
  --duration 240 \
  --style 三渲二国风 \
  --genre 仙侠 \
  --out output/demo/script.json

输出 script.json 结构

{
  "title": "归剑录",
  "style": "三渲二国风",
  "genre": "仙侠",
  "duration_total": 240,
  "scene_duration": 5,
  "logline": "...",
  "characters": [
    {
      "id": "C1",
      "name": "顾青崖",
      "age": "18",
      "visual": "白衣剑仙,剑眉星目,发束玉冠,腰佩青玉剑",
      "personality": "沉稳内敛",
      "voice": "zh_male_qingnian"
    }
  ],
  "scenes": [
    {
      "id": "S01",
      "location": "青崖峰绝顶",
      "time": "黎明",
      "characters": ["C1"],
      "action": "少年立于云海之上,长剑出鞘",
      "dialogue": [{"char": "C1", "text": "三年归来,该了结旧怨了"}],
      "camera": "远景→中景推近",
      "duration": 5,
      "mood": "苍凉壮阔"
    }
  ]
}

Agent 模式

Claude Agent 可直接按 schema 写 script.json,跳过 Python 脚本。脚本仅作为 fallback(Anthropic SDK 调用)和校验器。

国风提示词模板

脚本内嵌 PROMPT_TEMPLATE,对不同 genre 选用对应叙事节奏:

  • 仙侠:起兴→伏笔→反转→决战
  • 宫斗:暗流→试探→反击→结局
  • 江湖:相遇→比武→情义→重逢
  • 志怪:诡异→探查→真相→启示

Comments

Loading comments...