TSW Shorts Factory

Autonomous YouTube Shorts video factory — zero cost, no external video API required. Generates quote-based short-form videos daily using edge-tts (free Micro...

Security Scan

The skill's files and runtime instructions conflict: the README says no credentials required (and tells you to set PEXELS_API_KEY), but the code hardcodes a Pexels API key and reaches into /root/.openclaw paths and external uploader scripts — this mismatch and cross‑workspace access are suspicious and should be fixed or explained before use.

Purpose & Capability

SKILL.md advertises a zero-cost, self-contained YouTube Shorts factory and documents setting PEXELS_API_KEY and YouTube OAuth. The registry metadata lists no required env vars, but pipeline.py hardcodes a PEXELS_KEY value and hardwired paths (e.g. /root/.openclaw/..., /root/tsw_videos) and references an external YT_UPLOADER script outside the package. Requiring or embedding an API key and depending on files in another workspace is not consistent with the claimed 'instruction-only, no credentials' footprint.

Instruction Scope

SKILL.md instructs the agent to set PEXELS_API_KEY and run local yt_setup.py and to provide a local quote file. The pipeline code, however, ignores any environment variable and uses a hardcoded PEXELS_KEY, a fixed QUOTE_LIBRARY path under /root/.openclaw, inserts a sys.path to another project, and invokes an uploader at /root/.openclaw/.../yt_uploader.py. The runtime behavior therefore reaches into other agent/workspace directories and executes external code not mentioned in the install instructions.

Install Mechanism

No install spec (instruction-only), which is low risk in itself. SKILL.md lists pip packages to install at deploy time (moviepy, edge-tts, google-api libs). The code bundle includes Python scripts that will be executed locally; because there is no package install step, the user will need to install dependencies manually as instructed.

Credentials

The README declares PEXELS_API_KEY and a YouTube OAuth token file as configuration, but the registry shows no required env vars. Worse, pipeline.py contains a hardcoded PEXELS_KEY literal (a plausible-looking API key). That is a credential embedded in the code (credential leakage or misuse) and contradicts the deployment instructions. The code also creates and writes logs and outputs under /root/.openclaw and /root, accessing directories outside the skill bundle.

Persistence & Privilege

The skill writes logs and tokens to /root/.openclaw/workspace and creates directories under /root — touching what appears to be the agent's workspace and other projects. It also invokes an uploader script located outside the skill (YT_UPLOADER at /root/.openclaw/.../yt_uploader.py). While always:false (not forced), executing code that reaches across workspaces and calls external scripts increases blast radius and can modify or rely on other skills' artifacts.

What to consider before installing

Do NOT install or run this skill as-is. Key concerns to resolve before trusting it: 1) The pipeline contains a hardcoded Pexels API key — treat that as a leaked credential. Replace it with an env var and rotate the key if you care about the account. 2) The code references and executes an external uploader and inserts sys.path entries into /root/.openclaw — ask the author why external workspace files are required, or remove those references and bundle any necessary uploader code. 3) Confirm QUOTE_LIBRARY and output paths are configurable and do not point into other agent/system workspaces; run in a sandboxed account first. 4) Review the uploader (yt_uploader.py) and any referenced external scripts before execution because they run with the same privileges as the pipeline. 5) If you want to proceed, edit the code to use an environment variable for PEXELS_API_KEY (and other secrets), remove hardcoded absolute paths, include or document the uploader dependency, and only then run in a controlled environment. If you cannot get clear answers from the author, treat this package as untrusted.

Zero-cost autonomous YouTube Shorts pipeline. Ships 3 videos/day, no paid APIs.

Stack: edge-tts (free) → Pexels clips (free API) → MoviePy (local) → YouTube upload

Quick Deploy

# 1. Install dependencies
pip install moviepy edge-tts google-api-python-client google-auth-oauthlib pillow

# 2. Set Pexels API key (free at pexels.com/api)
export PEXELS_API_KEY="your_key_here"

# 3. Set up YouTube OAuth (one-time)
python3 scripts/yt_setup.py  # Opens browser for auth

# 4. Prepare quote library
cp assets/sample_quotes.json quote_library.json  # Or provide your own

# 5. Run once to test
python3 scripts/pipeline.py

# 6. Add to cron (3x daily)
# 0 8,14,20 * * * cd /your/path && python3 scripts/pipeline.py >> pipeline.log 2>&1

Quote Library Format

{
  "motivational": [
    {"quote": "Champions keep playing until they get it right.", "author": "Billie Jean King"},
    {"quote": "The secret of getting ahead is getting started.", "author": "Mark Twain"}
  ],
  "sports_quotes": [
    {"quote": "I am the greatest.", "author": "Muhammad Ali"}
  ]
}

Supported niches: motivational, sports_quotes, business_quotes, film_tv_quotes, wisdom_philosophy

Video Output

• Format: MP4, vertical 1080x1920 (Shorts-optimized)
• Duration: matches TTS audio length (~15–45 seconds)
• Text overlay: quote + author, centered, white with black stroke
• Background: 4 rotating Pexels stock clips matched to niche
• Uploaded as unlisted drafts — human reviews before publishing

Configuration

Variable	Default	Description
PEXELS_API_KEY	required	Free at pexels.com/api
YT_TOKEN_FILE	~/.yt_token.pickle	YouTube OAuth token
OUTPUT_DIR	/tmp/tsw_output	Video output directory
AUDIO_DIR	/tmp/tsw_audio	TTS audio cache
CLIP_CACHE_DIR	/tmp/tsw_clips	Pexels clip cache (reused)

Cost

• edge-tts: free (Microsoft neural voices via unofficial API)
• Pexels: free tier (25,000 requests/month)
• MoviePy: free (local ffmpeg)
• YouTube API: free (10,000 units/day quota)
• Total: $0/month for ~90 videos/month

References

• YouTube setup: See references/youtube-setup.md
• Adding niches: See references/niche-config.md
• Troubleshooting: See references/troubleshooting.md