Skills/ClawHub/mv-sing-opener-skill

mv-sing-opener-skill@3.1.1

VERIFIED

Publisher claims: "人物说唱视频制作官。用户给**一个想拍的人物/主题 + 一条说唱音频**(音频可后补), 本 skill 让**图片里的人跟着这条音频开口说唱**,产出 **9:16** 的人物说唱视频; **速度=音频本身的速度(永不提速)**,成片长度=人声长度;单镜 ≤30 秒,超过就按句间切点自动拆镜。 **前置创作链固定四站、四个角色、四份记录**: ① 任务解读官(把用户原话拆成任务书,标已知/缺口/默认值)→ ② 创意总监(定母题、选点、结构、视觉、音频方案)→ ③ 钩子官(只写第一句,4 分制打分,锁定主钩)→ ④ 词作者(按方案与钩子写全词+出曲参数)。 **不内置任何人物、母题、场景、金句、模板文案**:全部按用户本次输入现场规划,推导链写进项目文件。 **无音频时**:④ 先交付歌词+出曲参数+**海绵音乐提示词**(30s/12bar、40s/16bar 一段式,主版+备选+逐字歌词); 音频回传后才进 ⑤–⑧;禁止从旧项目/其他目录借用音频,没有音频不得进入 ⑥⑦⑧。 **核心口径**:口型由参考音频驱动;单镜 ≤30 秒,超过就拆镜、绝不提速;各镜用同一张参考图,切点落在信息段; 画面零可读文字、不影射真人/IP/品牌;只支持图片素材。 **公共经验(10 条)**:概念可行才算成立;代际题材先给边界、不逼原谅;平台硬约束在写词阶段排除; 字秒比按口型打折(40s 140–150 字、每句 6–9 字为主);结构现代失败先行;钩子用「物+关系+落空」不踩血腥线; 40s 按信息段拆 3–4 镜;视觉锚点低于嘴、反复出现;风险换表达不删情绪。 触发词:人物说唱、照片说唱、让照片里的人说唱、图片人物说唱、30秒说唱、40秒说唱、说唱视频、rap视频、 人物rap、开口说唱、说唱开场、mv-sing-opener、说唱短视频、海绵音乐提示词、出曲提示词。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher kongzichixiangjiao · joined 0 days agoInstalls 0Last detonated 3 h ago
$clawhub install mv-sing-opener-skill
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-06 and scored it 81/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
Python subprocess execution detectedscripts/assemble.py:44 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/generate_images.py:319 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/upload_project.py:451 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/upload_project.py:536 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/generate_video.py:841 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/qa.py:67 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/generate_video.py:581 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/assemble.py:35 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL using raw IP addressscripts/generate_video.py:87 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedscripts/cut_audio.py:39 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Outbound HTTP to raw IP addressscripts/generate_video.py:87 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedscripts/generate_video.py:314 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL using raw IP addressscripts/_common.py:30 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addressscripts/config.example.json:13 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedscripts/cut_audio.py:49 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/cut_audio.py:67 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Outbound HTTP to raw IP addressscripts/config.example.json:13 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedscripts/generate_video.py:639 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/assemble.py:61 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/qa.py:71 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/generate_video.py:594 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Outbound HTTP to raw IP addressscripts/_common.py:30 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07

Cost to the agent

Instructions loaded
≈5,460 tok
1 file · 35 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

mv-sing-opener-skill@3.1.1 safety verdict: Verified 81/100 — KillerSkills