Video Messages from your openclaw
v0.1.2Generate and send video messages with a lip-syncing VRM avatar. Use when user asks for video message, avatar video, video reply, or when TTS should be delivered as video instead of audio.
⭐ 4· 3k·8 current·8 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (avatar video messages) match what the skill asks for: an 'avatarcam' binary to render VRM avatars and ffmpeg to post-process video. The declared npm/brew/apt installers align with providing those binaries.
Instruction Scope
Runtime instructions are focused on the task (generate TTS, run avatarcam, post via message). They reference reading TOOLS.md for configuration and checking $DISPLAY to decide on xvfb; the registry metadata did not declare TOOLS.md as a required config path or list environment checks, which is a minor mismatch but not a functional red flag. Instructions will run local binaries and send the generated video via the agent's message tool (expected for this capability).
Install Mechanism
Install spec uses a third-party npm package (@thewulf7/openclaw-avatarcam) to provide avatarcam and uses standard brew/apt packages for ffmpeg and xvfb. This is proportionate to the functionality but carries normal supply-chain risk because an unreviewed global npm package executes code on install and provides the avatarcam binary.
Credentials
The skill does not request secrets or credentials and only needs local binaries and (optionally) access to TOOLS.md and temporary files. It references $DISPLAY and Docker env var names in docs but does not require sensitive environment variables — access is proportionate to the task.
Persistence & Privilege
Skill does not request always:true or other elevated persistent privileges. Its install steps create a global npm binary if installed, which is normal for a tool; it does not modify other skills or system-wide OpenClaw configs beyond installing its own binary.
Assessment
This skill appears to do what it says: render lip-synced avatar videos and send them via the agent. Before installing, consider: 1) Inspect the npm package (@thewulf7/openclaw-avatarcam) source or run it in a sandbox because global npm installs can run arbitrary code. 2) Ensure TOOLS.md (the skill's config) is present and does not contain sensitive data you wouldn't want read by the skill. 3) Be aware generated videos are sent using the agent's messaging tool—verify that sending such media is appropriate for your privacy requirements. 4) Prefer installing in a controlled environment (container, VM) rather than directly on a sensitive host. If you want higher assurance, ask the skill author for a vetted release URL or review the npm package contents before global installation.Like a lobster shell, security has layers — review code before you run it.
latestvk97cbe73mx9h12v4ck5pgxq6v580es5t
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎥 Clawdis
Binsffmpeg, avatarcam
Install
Install ffmpeg (brew)
Bins: ffmpeg
brew install ffmpeg