launchclipBLOCK
Create reviewable launch videos and OSS promotion packets from repositories, products, briefs, and media.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
launchclip turns an idea or source media into an editable portrait or landscape video for YouTube and social media. Its premium cinematic lane separates concept selection, retention writing, narration performance, edit planning, visual authoring, sound, and rendered-output verification so the result develops as a film rather than a text slideshow.
LaunchClip does not post, upload, publish, or treat a rendered draft as human approval. The original local-first OSS promotion-packet workflow remains available as a separate legacy lane.
Install
LaunchClip requires Node.js 22 or newer. Local video rendering also needs FFmpeg/ffprobe; launchclip doctor reports the exact local capabilities without printing credential values.
Install the published CLI from npm:
npm install --global launchclip launchclip --version launchclip doctor
Or build and link the CLI from source:
git clone https://github.com/rogerchappel/launchclip.git cd launchclip npm ci npm run release:check npm link launchclip doctor
Licensing
LaunchClip's own source code is available under the MIT License. Its rendering stack includes separately licensed dependencies. In particular, Remotion uses the Remotion License, whose terms depend on the user or organisation. Review THIRD_PARTY_NOTICES.md and the current dependency terms before organisational or commercial use; LaunchClip does not relicense third-party packages.
Legacy promotion-packet quickstart
launchclip run ./my-oss-tool \ --out .launchclip/my-oss-tool \ --demo-cmd "npm run smoke" \ --demo-media "demo/screenshot.png" \ --angle "turns demo proof into launch content" \ --audience "developers shipping small OSS tools"
That creates the full dry-run packet, validates it for social review, and writes REVIEW.md.
Agent Skills
Launchclip ships two agent-facing skills for different cost and execution models:
- [
launchclip-create-video](skill
3c592a60f4ffOBSERVED · 2026-10-11Install
Commands as the repository documents them. They are shown, not run.
npm install --global launchclip
git clone https://github.com/rogerchappel/launchclip.git
npm install --global launchclip
git clone https://github.com/rogerchappel/launchclip.git
Host compatibility
What the documentation claims. We have not run a compatibility test.
| Host | Status | Notes |
|---|---|---|
| claude-code | mentioned | |
| codex | mentioned | |
| cursor | mentioned | |
| openclaw | mentioned |
What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
# launchclip Skill Use this skill when Roger wants to promote a local OSS repo with a reviewable packet before anything is posted. ## Workflow 1. Identify the repo path, intended audience, and approved demo command. 2. Ask before running non-trivial or state-changing demo commands. 3. Prefer the one-command dry-run workflow: ```bash launchclip run <repo> --out .launchclip/<repo-name> --demo-cmd "<command>" --angle "<social angle>" --audience "<target audience>" ``` 4. For manual staging, run `init`, `demo`, `plan`, `captions`, `render --dry-run`, `submit-review --dry-run`, `validate`, and `review`. 5. Inspect `demo/terminal.txt` and `demo/command-receipt.json`; launchclip redacts common secret patterns, but agents should still verify no sensitive values are present. 6. Present `REVIEW.md` and `review/social-readiness.json` for human review. ## Side-Effect Boundaries - Do not post to social media. - Do not submit live product-videogen or Clutch Cut requests unless local config, explicit approval, and a future supported submission path are present. - Do not publish packages, tag releases, merge PRs, or create GitHub Releases. - Treat generated captions as drafts. - Treat redacted receipts as review artifacts, not permission to run commands that print secrets. ## Validation Run `launchclip validate <workspace>` before using a generated packet. Run `npm test`, `npm run smoke`, or `npm run check` before handing off a launchclip repo change. ## Approval Checkpoints Human approval is required before final rendering, external uploads, Review Feed submission, social queueing, or posting.
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (7 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (16)
HeyGen, read HeyGen credentials, or authorize use of a likeness. Confirm that
async function localInference({ prompt, model, baseUrl = "http://127.0.0.1:11434", signal }) {async function localInference({ prompt, schema, model, baseUrl = "http://127.0.0.1:11434", signal }) {tick: "data:audio/wav;base64,UklGRuQDAABXQVZFZm10IBAAAAABAAEAQB8AAIA+AAACABAAZGF0YcADAAAAABMAQABkAF4AGwCp/zL/7/4N/5f/aQA7AbkBoQHnALz/gv6x/aL9cv7q/44ByQIcA1QCpACX/uX8MvzR/KD+CwE8A2gEEQRDAoz/2vwj+xD7vvy
hit: "data:audio/wav;base64,UklGRlQCAABXQVZFZm10IBAAAAABAAEAQB8AAIA+AAACABAAZGF0YTACAAAAADsAjABEAFT/kv7+/p4AKwISAgAAev3E/N3+UwI7BKYChv4y+7H7AAC+BNUF+gEV/BL5xvtOAlYHcwYAACP5sfc5/W8Ffgm5Ber8RvaI9wAA3Aij
click: "data:audio/wav;base64,UklGRlQCAABXQVZFZm10IBAAAAABAAEAQB8AAIA+AAACABAAZGF0YTACAAAAADsAjABEAFT/kv7+/p4AKwISAgAAev3E/N3+UwI7BKYChv4y+7H7AAC+BNUF+gEV/BL5xvtOAlYHcwYAACP5sfc5/W8Ffgm5Ber8RvaI9wAA3A
tick: "data:audio/wav;base64,UklGRuQDAABXQVZFZm10IBAAAAABAAEAQB8AAIA+AAACABAAZGF0YcADAAAAABMAQABkAF4AGwCp/zL/7/4N/5f/aQA7AbkBoQHnALz/gv6x/aL9cv7q/44ByQIcA1QCpACX/uX8MvzR/KD+CwE8A2gEEQRDAoz/2vwj+xD7vvy
whoosh: "data:audio/wav;base64,UklGRgQHAABXQVZFZm10IBAAAAABAAEAQB8AAIA+AAACABAAZGF0YeAGAAAAAAMACgAXACgAPQBVAG8AiQCiALkAzQDcAOUA5wDhANIAugCZAG8APQADAMP/fv83//D+qv5p/i/+/v3Z/cL9u/3F/eH9D/5P/qH+A/9x/+v/b
cinematic_boom.wav
fast_whoosh.wav
riser_sudden_cut.wav
return createHash("sha1").update(String(value)).digest("hex").slice(0, 8);generateMusic(temp, { duration: 12, output: "../../outside.mp3" }),bundle.shot_id = "../../outside";
- Explicitly select `options.model` to use an installed local Ollama model. The default endpoint is `http://127.0.0.1:11434`; the built-in adapter only accepts loopback URLs and refuses redirects. Thi
@anthropic-ai/sdk
Gates applied: no_behavioural_pass.
3c592a60f4fffull audit observations/trust-audit/skill/rogerchappel__launchclip.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 3c592a60f4ff | BLOCK | D | 69 | first audit |
Questions
What does the launchclip skill do?
Create reviewable launch videos and OSS promotion packets from repositories, products, briefs, and media.
Is launchclip safe to install?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What can launchclip access on my machine?
The audit observed that it reaches the network. Each of those is consistent with what it says it does. Secrets in the source: none found.
Which assistants does launchclip work with?
Its documentation mentions claude-code, codex, cursor and openclaw. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (3c592a60f4ff), read on 2026-10-11. The repository is watched, and a new audit runs when it changes — this is the first audit.