Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Whiteboard Video Workflow
v0.1.0从 SRT 字幕文件自动生成完整白板动画视频的端到端工作流。依次完成分镜解析、图片生成、视频生成三个阶段。当用户提供 SRT 文件并要求生成白板动画视频,或说"从字幕生成白板视频"、"白板视频工作流"时触发。
⭐ 0· 24·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill's purpose (SRT → whiteboard video) matches the included scripts (storyboard parsing, prompt generation, image/video generation). However the implementation requires a RunningHub API key and also calls a setup script located in a sibling directory 'whiteboard-animation' (check_env.py references ANIMATION_SKILL/scripts/setup_env.py). The package metadata declares no required env vars or skill dependencies — that's inconsistent and unexpected.
Instruction Scope
SKILL.md tightly defines steps and limits work to specific scripts/files, which is good, but instructions require: (a) running scripts that will auto-install dependencies (check_env.py will execute setup_env.py in another skill), (b) reading/writing absolute paths inside the skill tree, and (c) passing absolute paths/expanded values into subagents. The runtime will therefore execute local setup scripts and touch sibling-skill files — this expands scope beyond the single skill and is not declared.
Install Mechanism
There is no formal install spec (instruction-only), which is lower risk. But the runtime helper (check_env.py) will invoke a setup script (setup_env.py) to create/verify a Python virtualenv and install libraries; that installation happens at execution time and will run arbitrary code from the referenced setup script. The setup script lives outside this skill (whiteboard-animation), increasing uncertainty about what will be installed/executed.
Credentials
The scripts clearly require a RUNNINGHUB_API_KEY (generate-image.py posts to https://www.runninghub.cn and check_env.py insists on RUNNINGHUB_API_KEY in a .env file). Yet the skill metadata lists no required env vars or primary credential. Requesting and using an API key for an image-generation service is reasonable for this task, but the omission in metadata is a meaningful inconsistency. Also the skill expects access to a sibling skill's setup script, which is an undeclared external dependency.
Persistence & Privilege
The skill does not request 'always' or other elevated platform privileges. It runs subagents and local scripts but does not persistently modify other skills' configuration. The main concern is that check_env.py will execute setup_env.py (in another skill), which can modify the environment or install packages — review that script before running.
What to consider before installing
This skill mostly does what it claims, but there are inconsistencies you should verify before installing or running it:
- Metadata omission: The code expects a RUNNINGHUB_API_KEY (checked in check_env.py and used by generate-image.py) but the registry metadata does not declare any required environment variables. If you plan to use this skill you will need to provide a RunningHub API key (placed in <skill-dir>/.env or exported into environment).
- Undeclared dependency on another skill: check_env.py tries to call a setup script in a sibling directory named 'whiteboard-animation' (scripts/setup_env.py). Confirm that this other skill and its setup_env.py exist and inspect that script before allowing it to run — it will install packages and execute arbitrary code.
- Audit the setup/install scripts: check_env.py will attempt to auto-install dependencies via the referenced setup_env.py. Treat any install script as potentially dangerous until you read it. Run installs in a sandbox or container, or review the code and packages it installs.
- Least-privilege for API key: if you provide a RunningHub key, prefer a key/account with minimal permissions and monitor usage. Consider testing with a dummy/limited key first.
- Network activity: image generation contacts https://www.runninghub.cn and downloads result URLs. If you must avoid network exfiltration, do not run the scripts or run them in an isolated environment.
- If you are not comfortable: request the publisher to update registry metadata to declare RUNNINGHUB_API_KEY and to document the dependency on whiteboard-animation (and ideally bundle or reference a vetted setup script). Otherwise classify this skill as moderate risk and only run after manual code review and in a controlled environment.Like a lobster shell, security has layers — review code before you run it.
latestvk975mvbqeyzxzs2be7g9zhcc19846j0j
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
