Short Video Script Creator

短视频核心脚本创作，通过专属参数清晰区分产品信息、口吻对标、内容对标及历史文案，批量生成高质量脚本，原生支持PDF/Word。

Security Scan

The skill appears to perform its stated short-video script generation, but it embeds a hard-coded model API key and calls an undisclosed external model endpoint without disclosing this in SKILL.md, which is disproportionate and could leak your input files/prompts.

Purpose & Capability

The skill's stated purpose is generating short-video scripts from local files. However, instead of asking the user to supply a model/API credential, the code contains a hard-coded API_URL and API_KEY and will send prompt/file contents to that external endpoint. The embedded network call and credential are not declared in the skill metadata or SKILL.md and are not necessary to describe the skill's purpose (the tool could have required the user to provide credentials or documented the remote service).

Instruction Scope

SKILL.md instructs the user to run scripts/main.py and to provide local files. The runtime code reads arbitrary files provided on the command line (pdf/docx/txt/md) and embeds their contents into the generated prompt, then --optionally-- sends that prompt (and therefore file contents) to an external model endpoint. The SKILL.md does not disclose that data will be transmitted off-host to a third-party API nor that an embedded API key is used. The code also prints the prompt replacements (print(replacements)), exposing file contents to stdout logs.

Install Mechanism

There is no install spec (instruction-only + Python script). Dependencies (docx, PyPDF2, aiohttp) are plausible for the declared functionality. No remote downloads or extract/install steps were found.

Credentials

The skill requests no environment variables in metadata but contains a hard-coded secret API_KEY in scripts/main.py and a hard-coded API_URL. This is disproportionate: a networked model call should be either clearly documented with a required credential or implemented to use a user-supplied env var rather than embedding a secret. The default output directory is hard-coded to a Windows user path (C:\Users\EDY\...), which is odd and suggests leftover developer-specific configuration.

Persistence & Privilege

The skill is not always: true and is user-invocable only. It writes files under a DEFAULT_OUTPUT_DIR (hard-coded path into a .openclaw skills subdirectory) — it does not request system-wide privileges or modify other skills. Hard-coded user-specific output path is unusual but not a high privilege escalation by itself.

Scan Findings in Context

[hardcoded-credential-in-source] unexpected: scripts/main.py defines API_KEY = "sk-..." inline. A script that calls a remote model should not embed a private key; it should require the user to supply credentials or document the service. This is not expected for a straightforward script-generation skill.

[unspecified-external-endpoint] unexpected: The model API endpoint API_URL = "https://api2.aigcbest.top/v1/chat/completions" is a third-party domain not disclosed in SKILL.md. SKILL.md does not warn that user data/files will be transmitted to this endpoint.

[hardcoded-output-path] unexpected: DEFAULT_OUTPUT_DIR is hard-coded to a Windows path with a specific username (C:\Users\EDY\...), which is unusual and may cause unexpected writes or reveal developer-specific configuration.

What to consider before installing

Do not run this skill until you are comfortable with where your inputs will be sent. Specific recommendations: - Inspect or remove the hard-coded API key and API URL in scripts/main.py. Treat the embedded key as compromised. - Prefer that the skill require the user to provide an API key via an environment variable (e.g., OPENCLAW_MODEL_API_KEY) rather than embedding one. - Verify the external service (api2.aigcbest.top): check its owner, privacy policy, and whether you trust it to receive any file contents you pass to the tool. - If you must test, run the script in an isolated environment (air-gapped VM) and avoid passing sensitive files; or modify the code to disable network calls (e.g., remove/guard the model_gpt call) so generation happens locally or with your trusted provider. - Ask the skill author to: (1) remove embedded secrets, (2) document the external endpoint in SKILL.md, and (3) use a configurable env var for API credentials and a sensible, non-user-specific output path. If the author cannot or will not do this, consider the skill unsafe for use with confidential data.

功能

本技能通过高度结构化的参数，能清晰地区分口吻对标、内容对标和历史风格参考，实现精准的、多维度的短视频脚本创作。

• 创作模式: 无任何对标或参考时，自由创作。
• 口吻对标模式: 严格模仿--benchmark-script-file中的人物说话方式。
• 内容对标模式: 严格模仿--competitor-script-file中的内容结构、主题和节奏。
• 混合对标模式: 模仿A的口吻，去改写B的内容。

所有输入文件原生支持 .pdf, .docx, .md, .txt 格式。

标准操作流程 (SOP)

1. 构建参数：在接收到生成指令后，我会首先解析您的需求，并将所有文件和要求映射到下方的参数列表中。
2. 提交审核：在执行任何操作前，我会将整理好的参数列表发送给您进行审核。
3. 等待确认：我将暂停执行，直到收到您“可以”或“继续”的明确指令。
4. 执行生成：收到您的确认后，我才会启动脚本。

使用方法

# 前提：确保 python 命令在系统环境中可用 (已添至 PATH)
python scripts/main.py `
    --count 3 `
    --min-words 400 `
    --max-words 500 `
    --name "品牌IP名称" `
    --customer-background "出镜人：[专家姓名]，[所属领域]专家..." `
    --product-info "[产品名称]，一款帮助用户[实现价值]的[产品类别]..." `
    --battle-map-file "path/to/your/battle_map.pdf" `
    --product-info-file "path/to/your/product_details.docx" `
    --call-model

参数说明

参数	必填	说明
--count	是	生成脚本数量
--min-words, --max-words	是	字数范围
--name	否	出镜人名称
--customer-background	是	客户背景描述
--product-info	否	核心产品一句话简述
--extra-requirements	否	额外的、一次性的文案要求
--battle-map-file	是	作战地图文件路径
--product-info-file	否	产品详细介绍文件路径
--benchmark-script-file	否	(口吻对标) 指定口吻的参考文件
--competitor-script-file	否	(内容对标) 指定模仿内容结构/主题的脚本文件
--historical-script-files	否	(风格参考) 历史文案文件列表（用于参考，避免重复）
--call-model	否	是否直接调用大模型

提示词模板

### **【启动模板】**

## 1. 核心任务

你是一位顶级的IP文案策划师，拥有从多人对话中精准锁定并提炼“出镜人”独特口吻的卓越能力，并能根据核心策略文档和参考文案创作高质量短视频脚本。你的任务是基于我提供的全部信息，深度分析指定出镜人的真实说话风格、用词习惯和思维方式，创作出与他/她本人高度一致、仿佛亲口说出的高质量文案。

## 2. 输入信息

### 2.1. 出镜人信息

- **出镜人名称：** {{name}}
- **核心人设与背景：** {{customer_background}}

### 2.2. 核心策略与产品

- **核心策略 (作战地图):** ``` {{battle_map_content}} ```

- **核心产品 (简述):** {{product_info}}

- **产品介绍 (详细):** ``` {{product_info_content}} ```

- **内容要点 (会议纪要):** ``` {{meeting_notes_content}} ```

### 2.3. 对标与参考

- **口吻对标 (模仿谁的说话方式):** ``` {{benchmark_content}} ```

- **内容对标 (模仿谁的内容结构):** ``` {{competitor_content}} ```

- **历史文案 (参考风格，避免重复):** ``` {{historical_content}} ```

### 2.4. 文案要求

- **文案数量:** {{count}}
- **文案字数:** 控制在 {{min_words}}~{{max_words}} 字
- **额外要求:** {{extra_requirements}}

## 3. 创作流程与要求

1.  **模式判断:**
    - **若提供了“内容对标”:** 我的核心任务是**改写**这份文案。
      - **如果同时提供了“口吻对标”:** 我将用“口吻对标”的说话风格，去重新讲述“内容对标”的核心思想。
      - **如果未提供“口吻对标”:** 我将用出镜人自己的风格（根据背景推断）去改写。
    - **若未提供“内容对标”，但提供了“口吻对标”:** 我的核心任务是**模仿**这个口吻，根据核心策略和产品信息，创作全新的脚本。
    - **若均未提供:** 我将根据所有基础信息，进行纯粹的**原创**。
2.  **风格参考:** 在上述所有模式中，如果提供了“历史文案”，我都会参考其风格，并确保新脚本的选题不与之重复。
3.  **高质量创作：** 确保文案有趣、有料、有共鸣，并严格遵循提炼出的口吻风格。
4.  **变现确认（可选）：** 如果文案需要围绕变现，则添加适当的转化钩子。
5.  **其他要求：**
    - 确保文案符合平台标准，不能违规。
    - 不要出现“作战地图”、“作战室”这几个字。

## 4. 输出方式

本次需创作：{{count}}篇文案
最终输出格式为 Markdown，每个脚本之间用 `---` 分隔。严格遵循以下模板：

### Script 1: [脚本标题]

**核心卖点**: [该脚本聚焦的核心卖点]
**目标用户**: [该脚本主要面向的用户群体]

**[黄金三秒]**
（钩子文案）

**[主体内容]**
（主体文案）

**[引导行动]**
（结尾引导文案）