Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Story Video Skill

v1.5.1

当用户提到以下内容时触发此技能: 把故事做成视频、生成视频、故事视频、AI视频制作、文生视频、图生视频、剧本转视频、分镜生成、分镜头、导演分镜、编剧分析、故事分镜、需要分镜、给视频分镜、拍成视频、拍成分镜、generate video、story to video、video generation、video s...

0· 117·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for yhongm/story-video-skill.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Story Video Skill" (yhongm/story-video-skill) from ClawHub.
Skill page: https://clawhub.ai/yhongm/story-video-skill
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install story-video-skill

ClawHub CLI

Package manager switcher

npx clawhub@latest install story-video-skill
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's declared runtime behavior (generate shots.json, call MiniMax T2I and I2V, merge with ffmpeg) matches its name and description; requesting a MiniMax API key is appropriate for the stated purpose. However the registry metadata at the top of the evaluation (which listed no required env vars / no primary credential) contradicts the SKILL.md and README that both require MINIMAX_API_KEY. The manifest also contains duplicated file listings, which suggests sloppy packaging.
Instruction Scope
SKILL.md and the scripts confine actions to: parsing story text, calling the MiniMax API endpoints, downloading generated assets, and running ffmpeg to merge clips. There is no code or instruction to read unrelated system credentials or external endpoints beyond MiniMax. However SKILL.md contains detected unicode-control-chars (prompt-injection signal) embedded in the skill docs; invisible control characters can be used to manipulate prompt processing or hide content and should be inspected. The runtime scripts write outputs under the skill directory and /tmp, which is expected for this workload.
Install Mechanism
There is no install spec (no package manager downloads), which is lower risk. But this skill ships many Python scripts as part of the skill bundle — it's not truly 'instruction-only' despite the metadata claiming no install. Because code will be present on disk and executed by the agent (Python + ffmpeg), verify code before running. No remote install URLs or obscure download hosts were found in the included files.
Credentials
The only declared required secret is MINIMAX_API_KEY (plus optional MINIMAX_BASE_URL/MINIMAX_IMAGE_URL) which is proportional to a service-integration skill. The inconsistency between registry 'required env vars: none' and SKILL.md's required_environment_variables is concerning and should be resolved. No unrelated credentials (AWS, GitHub, etc.) are requested.
Persistence & Privilege
always is false and the skill does not request to modify other skills or system-wide settings. It writes outputs under its own output/ directory and /tmp only. Default autonomous invocation is allowed (platform-normal) and not combined with other major red flags.
Scan Findings in Context
[unicode-control-chars] unexpected: The SKILL.md contained unicode control characters according to the pre-scan. Invisible control characters are not necessary for a video-generation skill and can be used to hide or manipulate text; inspect SKILL.md and README in a raw/hex view before trusting the package. The rest of the code and endpoints appear normal and use api.minimaxi.com.
What to consider before installing
This skill appears to implement a legitimate story→video pipeline that uses a MiniMax API key. Before installing: 1) Confirm the skill source/trustworthiness (owner slug looks unknown). 2) Inspect SKILL.md and scripts locally for invisible characters (use cat -v, od -c, or a hex editor) and review the Python scripts (they call only MiniMax endpoints and ffmpeg). 3) Resolve metadata mismatches — the registry claims no required env vars but SKILL.md/README require MINIMAX_API_KEY. 4) Run the code in an isolated environment (container or VM) and do not supply high-privilege credentials — provide only a dedicated MiniMax API key with limited quota. 5) Be aware of cost/rate limits described in the README and ensure network access and ffmpeg are configured. If you lack the ability to review code, treat this package as higher risk and avoid granting it credentials or running it on sensitive hosts.

Like a lobster shell, security has layers — review code before you run it.

latestvk97bpx7axxsa6hsw00tztp1vsn85nh0e
117downloads
0stars
10versions
Updated 11h ago
v1.5.1
MIT-0

story-video-skill

技能概述

这是一个分镜脚本完整视频的 AI 制作流水线。

分镜脚本: 分析故事结构,设计人物对白,构建叙事节奏;建立人物串联线索,设计对应场景板;设计对比板式、建立人物关系图;设计对峙场面、构建起承转合。

视频流水线: 故事文本 → MiniMax T2I(图片生成)→ MiniMax I2V(图片转视频)→ ffmpeg 合并输出成片。

核心流程

故事文本 → 分镜JSON → T2I图片 → I2V视频 → ffmpeg合并 → 视频成片

第一步:生成shots.json

用户提供故事文本后,用 scripts/pipeline.py 生成 shots.json

python3 scripts/pipeline.py "你的故事大纲或剧本"

输出 output/screenplay/shots.json,包含每个分镜的:

  • shot_number:镜头编号
  • description:分镜描述(画面+动作+台词)
  • visual_prompt:视觉生成词(送入T2I)

第二步:生成并合并视频

scripts/full_pipeline.pyscripts/full_pipeline_v2.py 执行完整流水线:

export MINIMAX_API_KEY="你的key"
python3 scripts/full_pipeline.py output/screenplay/shots.json

流水线自动:

  1. 读取 shots.json
  2. 对每个分镜调用 MiniMax T2I 生成图片
  3. 对每张图片调用 MiniMax I2V 生成视频
  4. 用 ffmpeg 合并所有视频为单个成片

输出目录:output/videos/

脚本说明

脚本功能
scripts/pipeline.py故事文本 → shots.json 分镜脚本
scripts/full_pipeline.pyshots.json → T2I图片 → I2V视频 → ffmpeg合并
scripts/full_pipeline_v2.py同上,模型版本不同
scripts/generate_shot_images.py独立运行T2I图片生成
scripts/generate_shot_videos.py独立运行I2V视频生成

环境变量

变量必需默认值说明
MINIMAX_API_KEYMiniMax API密钥
MINIMAX_BASE_URLhttps://api.minimaxi.com/v1MiniMax API地址
MINIMAX_IMAGE_URLhttps://api.minimaxi.com/v1/image_generation图片生成端点

目录结构

story-video-skill/
├── SKILL.md                          # 本技能说明
├── README.md                         # 详细文档
├── output/
│   ├── frames/                      # T2I生成的图片
│   ├── videos/                      # I2V生成的视频 + 最终成片
│   └── screenplay/
│       └── shots.json               # 分镜脚本
└── scripts/
    ├── pipeline.py                  # 生成shots.json
    ├── full_pipeline.py             # 完整流水线 v1
    ├── full_pipeline_v2.py          # 完整流水线 v2
    ├── generate_shot_images.py      # T2I图片生成
    └── generate_shot_videos.py      # I2V视频生成

分镜设计原则

视觉叙事优先

  • 每个分镜有明确的主角视线和注意力焦点
  • 用「镜头角度 + 运动方式」代替「人物动作罗列」
  • 优先通过场景/道具/表情暗示情绪,少用直接台词

分镜描述格式

镜头编号 | 镜头类型 | 画面描述 | 台词/声音

情绪节奏把控

  • 开场30秒:建立世界规则,展示日常状态
  • 中段:矛盾积累,节奏加快
  • 高潮:情感爆发,动作密集
  • 收束:留白,克制

专业知识:编剧体系

故事结构模板

三幕占比核心
第一幕:建置25%开场钩子、日常世界、催化事件
第二幕:对抗50%进展升级、中点转折、灵魂黑夜
第三幕:解决25%高潮决战、结局收束

起承转合

阶段功能情绪
引入好奇
发展期待
转折紧张
解决满足

人物塑造

  • 性格三角:内在欲望 × 外在行为 × 他人评价
  • 关系对位:主角与对手形成镜像对照
  • 成长弧线:每个重要人物都有从A点到B点的变化

视觉风格指南

色调与光影

类型适合场景推荐色调
温暖怀旧回忆、亲情暖黄、褪色
冷峻现实困境、独立低饱和、冷蓝
奇幻冒险超现实、梦境高饱和、撞色
悬疑紧张秘密、危机暗调、阴影

镜头语言

镜头适合场景情绪效果
远景建立场景渺小感/史诗感
中景人物互动亲近感
特写情绪高潮冲击力
俯拍命运转折宿命感
仰拍英雄登场力量感

故障排除

T2I 生成失败

  • 检查 MINIMAX_API_KEY 是否有效
  • 缩短 visual_prompt(过长会被截断)
  • 避免敏感词(血腥/暴力内容会被拦截)

I2V 生成卡住

  • 确认 model 为 MiniMax-Hailuo-2.3
  • 检查图片URL是否可访问(需要公网可访问的HTTP链接)

ffmpeg 合并失败

  • 确保所有视频文件完整(非0字节)
  • 确认 ffmpeg 已安装:ffmpeg -version
  • 检查视频格式是否兼容(推荐MP4/H.264)

速率限制

  • MiniMax API 有速率限制,高并发时会429
  • full_pipeline.py 内置 exponential backoff 重试
  • 大量分镜建议分批处理

Comments

Loading comments...