The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires the user to provide multiple sensitive API keys (including keys for LLM, VLM, and various Text-to-Speech providers). These keys are written to the local config.toml file to configure the video editing services.
[DATA_EXPOSURE]: The helper script scripts/feishu_file_sender.py accesses the user's home directory to read ~/.openclaw/openclaw.json, which contains sensitive application secrets (appId and appSecret) used to authenticate with the Feishu platform.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user instructions via the --prompt argument and relays them to the backend OpenStoryline service without explicit sanitization.
Ingestion points: The prompt parameter in the scripts/bridge_openstoryline.py script.
Boundary markers: None identified; user input is passed directly into a JSON payload for websocket communication.
Capability inventory: The skill has the ability to modify local configuration files, perform network operations to external services (Feishu), and manage local service processes.
Sanitization: No input validation or filtering is performed on the prompt before it is processed by the downstream agent.
[COMMAND_EXECUTION]: The skill automates several shell-level operations, including starting local web services using uvicorn, managing the OpenStoryline MCP server, and executing internal Python scripts to bridge communication and send files.
[EXTERNAL_DOWNLOADS]: The documentation within SKILL.md instructs the user to install the requests library via pip to enable the file-sending functionality.

openstoryline-use