技能详情（站内镜像，无评论）
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v1.0.0
统计：⭐ 0 · 299 · 3 current installs · 3 all-time installs
⭐ 0
安装量（当前） 3
🛡 VirusTotal ：可疑 · OpenClaw ：可疑
Package：aryanbhasin/tiktok-slideshow
安全扫描（ClawHub）
- VirusTotal ：可疑
- OpenClaw ：可疑
OpenClaw 评估
The skill's behavior (calling an external ViralBaby API) matches its purpose, but the SKILL.md asks the agent to create accounts and persist API keys/passwords as environment variables while the registry metadata declares no required credentials — this mismatch and the instruction to store secrets in env vars are concerning.
目的
The name/description (TikTok slideshow via ViralBaby API) matches the runtime instructions: search images, build collections, edit slides, and upload drafts to TikTok. However, the registry metadata declares no required environment variables or primary credential, while the instructions clearly require and depend on an API key (VB_KEY) and optionally a saved password (VB_PASSWORD). That metadata mismatch should be corrected.
说明范围
The SKILL.md instructs the agent to sign up new users, log in, and 'immediately save' the returned API key and password as environment variables to persist across sessions. It also mandates fetching stored user preferences at session start and transmitting user business/product_info to the ViralBaby service. Asking the agent to create accounts and persist secrets, and to automatically fetch/store user preferences, expands the skill's runtime s…
安装机制
This is an instruction-only skill with no install spec and no code files, so nothing is downloaded or written during installation. That reduces install-time risk.
证书
Although the skill needs an API key and password at runtime, the registry declares no required env vars. The instructions also tell the agent to store credentials in environment variables (VB_KEY, VB_PASSWORD), which is a weak persistence mechanism (env vars can leak via process listings, logs, backups). Requesting persistent credentials is understandable for a third-party API, but storing raw passwords in env vars and the lack of declared req…
持久
always is false (good). However, the skill explicitly instructs the agent to persist credentials across sessions by exporting env vars; that implies long-term presence of secrets. The skill doesn't request to modify other skills or global agent settings, but the guidance to persist secrets is a notable privileged behavior the user should approve explicitly.
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「Tiktok Slideshow Maker」。简介：Creates TikTok image carousels (slideshows with text overlays on photos) via th…。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/aryanbhasin/tiktok-slideshow/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。