by 安全扫描
OpenClaw
可疑
high confidenceNULL
评估建议
Key points before installing:
- The skill advertises 'Vidu API' and automated AI video generation but the code only automates a browser to upload existing local videos; if you expected an API-based or auto-generation pipeline, this skill does not provide it. Ask the author for clarification or an updated README.
- The package uses Playwright but provides no install instructions or dependency declarations; you will need to install python-playwright and browser binaries yourself. Prefer running th...详细分析 ▾
⚠ 用途与能力
The skill name/description advertise a Vidu API and automated 24-hour AI video generation and one‑click publishing. The code, SKILL.md, and README do not call any 'Vidu' API, do not generate videos, and only implement browser automation to upload existing local video files. This mismatch (advertised API/auto-generation vs actual local-file publishing via Playwright) is an incoherence a user should note.
ℹ 指令范围
SKILL.md instructs the agent to open a browser, reuse or create login state, upload user-supplied video files, and fill titles/tags; that matches the code. It requires access to local video paths and to browser_state.json (Playwright storage state). The instructions do not ask the agent to read unrelated system secrets, but they do rely on reusing browser login state which may expose account cookies if mishandled.
⚠ 安装机制
There is no install spec despite the code importing and using Playwright (playwright.async_api) and expecting a browser runtime. Required dependencies (python-playwright, and browser binaries) are not declared. That omission is disproportionate: users will need to install Playwright and browsers manually; an install step should be provided and audited.
ℹ 凭证需求
The skill declares no environment variables or credentials (which is consistent with browser-based automation). However, it will access local files (the user-supplied video path) and a storage_state file (browser_state.json) containing browser authentication state — access to those should be considered sensitive. No unrelated credentials are requested.
✓ 持久化与权限
always:false and model invocation are default. The skill does not request permanent platform-wide privileges. It does read/use (and may write, depending on Playwright behavior) browser_state.json to persist login sessions; that is normal for browser automation but worth noting.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/20
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install vidu-video-publisher
镜像加速npx clawhub@latest install vidu-video-publisher --registry https://cn.longxiaskill.com