Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

world-as-100-people-video-gen

v1.0.1

Create ‘world as 100 people’ verticals: shrink hook, stat morphs, punchline, timed English captions and motion graphics (WeryAI). Use for infographic TikToks...

0· 133·0 current·0 all-time
byparallel world@zoucdr

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for zoucdr/world-as-100-people-video-gen.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "world-as-100-people-video-gen" (zoucdr/world-as-100-people-video-gen) from ClawHub.
Skill page: https://clawhub.ai/zoucdr/world-as-100-people-video-gen
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: WERYAI_API_KEY
Required binaries: node
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install world-as-100-people-video-gen

ClawHub CLI

Package manager switcher

npx clawhub@latest install world-as-100-people-video-gen
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description claim video generation using WeryAI; the package includes a Node.js CLI (scripts/video_gen.js), references WeryAI API hosts, and requires only node + WERYAI_API_KEY — all expected for this purpose.
Instruction Scope
SKILL.md and resources document the normal flows (text→video, image→video, multi-image) and explicitly prefer public https image URLs. The shipped script will read a local image file (if provided) and upload it to api-growth-agent.weryai.com using the WERYAI_API_KEY to obtain a public URL before requesting video generation. That local-file read-and-upload behavior is within scope for image→video but relies on the agent or operator to obtain explicit user consent before allowing local file access — if the agent doesn't honor that, local file exfiltration could occur. SKILL.md does call out this requirement and asks for review/consent.
Install Mechanism
There is no install spec and no external downloads; the skill is instruction-only with a bundled Node script. No network install from untrusted URLs is present. This is low installation risk.
Credentials
Only WERYAI_API_KEY is required and declared as the primary credential. The script reads no other environment variables. Requesting a single API key is proportional for a hosted video-generation service that needs auth.
Persistence & Privilege
The skill is not always-enabled, does not request elevated platform privileges, and does not modify other skills or global configuration. Autonomous invocation is allowed by default (normal for skills) but not combined with other concerning privileges.
Assessment
This package appears to do what it says: generate short videos via WeryAI and, when given local image paths, read the file and upload it to WeryAI's upload endpoint using your WERYAI_API_KEY. Before installing or running it: (1) do not commit your WERYAI_API_KEY to source control; prefer a short‑lived or scoped API key if WeryAI supports that; (2) prefer supplying public https image URLs so no local-file read/upload is necessary; (3) if you must allow local image paths, review scripts/video_gen.js yourself and explicitly consent to local file access — the SKILL.md asks for that, but make sure your agent actually enforces it; (4) verify the API host (api.weryai.com and api-growth-agent.weryai.com) and rotate keys after testing; (5) if you do not want the skill invoked autonomously, disable autonomous invocation in your agent settings or require manual confirmation before runs.
scripts/video_gen.js:675
Environment variable access combined with network send.
!
scripts/video_gen.js:223
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

👥 Clawdis
Binsnode
EnvWERYAI_API_KEY
Primary envWERYAI_API_KEY
latestvk975bn27mar98zd5jqwjz3pr5583ecse
133downloads
0stars
2versions
Updated 1mo ago
v1.0.1
MIT-0

World as 100 people (icons + stat race + punchline)

Template (assume duration 10 unless scaled): 0–2s shrink the world to 100 people; 2–9s rapid visual changes (wealth split, gender, access to water/internet, etc.—user picks themes); 9–10s one shocking or memorable stat line (user-themed). English on-screen text with exact windows. Default duration is 10 when unspecified.

Dependencies: WERYAI_API_KEY + Node.js 18+. scripts/video_gen.js + WERYAI_VIDEO_API.md. No other Cursor skills required.

Prerequisites

  • WERYAI_API_KEY must be set; Node 18+. Prefer public https image URLs; if the assembled scripts/video_gen.js supports local file paths, review/verify the script and explicitly consent before local read-and-upload to WeryAI.
  • Non-empty model in JSON.

Security, secrets, and API hosts

  • WERYAI_API_KEY: Secret; never commit.
  • API hosts fixed in video_gen.js as in sibling skills—only the key is read from env.
  • Local image handling disclosure: Prefer public https image URLs. If the assembled scripts/video_gen.js supports local file paths, it may read a local image and upload it to WeryAI to obtain a public URL; require review / verification and explicit consent before using that path.
  • Higher assurance: Prefer a short-lived or isolated environment; review scripts/video_gen.js before production use. Verify whether the runtime can read local image files and upload them to WeryAI, and obtain explicit consent before using that path.

Prompt expansion (mandatory)

  • Duration: Default 10; 5 or 15 when allowed and requested.
  • Timeline scaling: Rescale hook / middle / punchline segments proportionally; keep hook → three middle beats → final punchline order.

Locked rhythm (example for duration 10):

  • 0.0–2.0s — Hook: e.g. SHRINK EARTH TO 100 PEOPLE.
  • 2.0–4.0s, 4.0–6.0s, 6.0–9.0sThree rotating stat / theme lines (user brief): e.g. WEALTH SHIFTS / GENDER / WHO GETS WHAT—keep labels short; pair each with icon morph, pie wipe, or counter tick.
  • 9.0–10.0sPunchline stat (one short English line the user intends—e.g. ONLY X HAVE Y).

Visuals: Isometric or flat UI icons, glow, snappy transitions (~1s); no tiny unreadable numbers unless the caption carries the readable stat.

Typography: Bold sans, outline, lower third; English only unless user requests otherwise.

Audio: Light digital ticks / whoosh if audio on.

Negatives (Kling): garbled numbers, illegible text, watermark.

Confirmation: Full expanded prompt in table.

Niche checklist

  • Prefer one clear metaphor per middle window.
  • Punchline must be one screenful—no paragraph.

Workflow

  1. Text / image / multi-image (SEEDANCE_2_0 only, ≤3 URLs).
  2. Collect which stats or angles to imply (user may give Chinese—translate lines to English on screen).
  3. Expand with timed captions + motion graphics language.
  4. Validate JSON vs frozen tables.
  5. Confirm → wait.
  6. [Video](url) only for playable links.

CLI reference

node scripts/video_gen.js wait --json '{"model":"KLING_V3_0_PRO","prompt":"…","duration":10,"aspect_ratio":"9:16","generate_audio":true,"negative_prompt":"illegible text, garbled numbers, watermark"}'
node scripts/video_gen.js wait --json '{"model":"SEEDANCE_2_0","prompt":"…","duration":10,"aspect_ratio":"9:16","resolution":"720p","generate_audio":true}'

Full reference: WERYAI_VIDEO_API.md.

Definition of done

Video or error; prompt includes 0–2 / 2–4 / 4–6 / 6–9 / 9–10 (or user-approved adjustment) subtitle schedule.

Boundaries (out of scope)

  • Not verified census data—illustrative motion; user owns factual claims.
  • No negative_prompt on Seedance; no unsupported fields.
  • resources/WERYAI_VIDEO_API.md for CLI details.

Example prompts

  • Focus: internet access, education, wealth—punchline about inequality
  • Climate + water + energy icons, last line about renewable share
  • Three chart images URLs → Seedance multi-image, same caption windows
  • Healthcare access vs wealth percentiles—punchline about who gets left out

Model and API constraints (frozen for this skill)

Text-to-video

model_keydurationsaspect_ratiosresolutionsaudionegative_promptprompt limit
KLING_V3_0_PRO5, 10, 159:16, 1:1, 16:9(omit)yesyes2000
KLING_V3_0_STA5, 10, 159:16, 1:1, 16:9(omit)yesyes2000
SEEDANCE_2_05, 10, 159:16, 1:1, 16:9480p, 720pyesno2000

Image-to-video

model_keydurationsaspect_ratiosresolutionsaudionegative_promptimage slots
KLING_V3_0_PRO5, 10, 159:16, 16:9, 1:1(omit)yesyessingle image
KLING_V3_0_STA5, 10, 159:16, 16:9, 1:1(omit)yesyessingle image
SEEDANCE_2_05, 10, 159:16, 1:1, 16:9480p, 720pyesnoup to 3 images

Recommended models

Tiermodel_keyDefault duration
⭐ BestKLING_V3_0_PRO10
👍 GoodKLING_V3_0_STA10
⚡ FastSEEDANCE_2_010 (resolution: 720p)

Default parameters

FieldValue
aspect_ratio9:16
duration10
generate_audiotrue
resolution720p (Seedance)
negative_promptKling: illegible text, garbled captions, watermark

Text-to-video (primary)

User lists themes → you assign lines + seconds → confirm → wait.

Image-to-video (optional)

Charts / icons stills → animate under same windows.

Tips

  • If user gives too many themes, merge into three middle beats.
  • Punchline hits harder with a contrast number (still short).

Packaged as world-as-100-people-video-gen.

Comments

Loading comments...