Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Video Generator CLI

v5.0.0

Guide for running the Video Generator CLI commands.

0· 121·0 current·0 all-time
byPremkmar M@itspremkumar

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for itspremkumar/video-gen-cli.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Video Generator CLI" (itspremkumar/video-gen-cli) from ClawHub.
Skill page: https://clawhub.ai/itspremkumar/video-gen-cli
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install video-gen-cli

ClawHub CLI

Package manager switcher

npx clawhub@latest install video-gen-cli
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
SKILL.md requires node, npm, ffmpeg, python and a PEXELS_API_KEY which all make sense for a video generator that downloads stock footage and assembles + transcodes video. However the registry-level requirements reported above list no required binaries and no required env vars. That mismatch (manifest vs SKILL.md) is incoherent and should be resolved — a consumer cannot tell which requirements are authoritative.
Instruction Scope
The instructions stay within the scope of running a local CLI: wiping a .video-cache.json, cleaning public/ folders, reading input/input-scripts.json, downloading stock footage, rendering segments, and stitching with ffmpeg. One ambiguity: SKILL.md says it 'generates voiceovers' and names AI voice IDs but does not declare what TTS service or credentials (if any) are used. That could require additional secrets or network calls not declared in the file.
Install Mechanism
This is an instruction-only skill with no install spec and no code files. That is low-risk from an install/extraction perspective — nothing is downloaded or written by a packaged installer described here.
!
Credentials
SKILL.md lists PEXELS_API_KEY as a required env var which is proportionate for downloading stock footage. But the registry metadata reported earlier lists no required env vars. The mismatch is concerning because it hides a declared credential requirement from the registry-level summary. Also the voice synthesis step mentions AI voice IDs but no TTS credentials are declared; additional credentials may be required but are not specified.
Persistence & Privilege
The skill is not always-enabled, is user-invocable, and has no install script that writes persistent configuration. It does not request elevated persistence or system-wide configuration changes.
What to consider before installing
Before using this skill: (1) Confirm which manifest is authoritative — the registry summary or the SKILL.md — because SKILL.md requires node/npm/ffmpeg/python and PEXELS_API_KEY while the registry metadata shows none. (2) Inspect the project's package.json and the actual CLI scripts (npm scripts) referenced (generate, resume, segment, dev) in a trusted code review environment before running them; the SKILL.md explains behaviors such as wiping .video-cache.json and clearing public/videos and public/audio, so back up any important files beforehand. (3) Ask or inspect where 'voiceover generation' is performed — it may call an external TTS service and require additional credentials you should not supply blindly. (4) Limit the PEXELS_API_KEY scope (use a dedicated key) and verify network endpoints used by the tool. (5) Because this skill is instruction-only (no bundled code), prefer installing and reviewing the actual project source from a trustworthy repository prior to execution. If you cannot resolve the manifest mismatch or determine the TTS behavior, treat this skill with caution and avoid running destructive commands (generate/build) until you can audit the code.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ez2k6m09c7qzcaag4nca32584dqhx
121downloads
0stars
4versions
Updated 2w ago
v5.0.0
MIT-0

Video Generator CLI Operations Skill

This skill explains the different terminal commands available to run, resume, or fix video generations.

1. Standard Generation Commands

These commands are used for a "Fresh Start." They clean up old temporary files to prevent conflicts.

npm run generate (or npm run build)

  • What it does:
    1. Wipes the .video-cache.json file.
    2. Cleans the public/videos and public/audio folders.
    3. Parses your script from input/input-scripts.json.
    4. Downloads new stock footage and generates voiceovers.
    5. Renders the video scene-by-scene (Segmented Mode).
  • When to use: When you have a new script or want to see fresh visuals for an existing script.

2. Advanced Recovery Commands

These commands save time by reusing already-completed work.

npm run resume

  • What it does:
    1. Preserves everything in public/ and the .video-cache.json.
    2. Only downloads visuals/audio that are missing.
    3. Only renders segments that don't exist yet in the output folder.
    4. Automatically stitches everything together at the end.
  • When to use: If your computer crashed, or you lost internet during a long generation. It will pick up exactly where it left off.

npm run segment

  • What it does:
    1. Skips ALL asset fetching and generation.
    2. Jumps directly to "Phase 7: Assembly."
    3. Takes the existing .mp4 segments in your output folder and merges them.
  • When to use: Use this if the video was rendered successfully but the final "stitching" failed or if you want to manually re-assemble the segments.

3. Developer / Debugging Tools

npm run dev

  • What it does: Starts the local asset server.
  • When to use: Only needed if you are manually debugging the Remotion components in the browser.

4. Operational Summary

CommandActionFresh/Resume
npm run generateFull ProcessFresh (Wipes old data)
npm run buildFull ProcessFresh (Alias for generate)
npm run resumeSkip ExistingResume (Saves time)
npm run segmentAssembly OnlyFix (Stitching only)

5. Configuration (JSON Script)

When editing input/input-scripts.json, agents can use these newer properties:

PropertyTypeDescription
showTextBooleanSet to false to disable on-screen subtitles.
defaultVideoStringFilename in input/input-assests/ to use as a visual fallback.
orientationStringportrait or landscape.
voiceStringAI voice ID (e.g., en-US-JennyNeural).

Comments

Loading comments...