clipforge
ClipForge（原『带货剪手』/ daihuo-jianshou）：开源 AI 带货短视频神器——上传一张商品图，AI 自动提炼卖点 + 写种草脚本 + 锁定商品原图不变形 + 配画面/配音/字幕，一键产出抖音小店 / 快手 / 小红书 / TikTok Shop 卖货短视频。0 成本批量出片、开源无水印、本地自部署。也支持一句话主题成片。Open-source AI e-commerce/UGC short-video generator.
Not matched to a published package yet
The main safety concern is that AI-generated sales scripts may make false product claims, and any external APIs used could leak metadata—always review output before publishing and understand what services it connects to.
Based on public adoption and transparency signals as of Oct 23, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachConnects to outside service APINOTED
- CredentialsNo API token requiredLOW
- Package sourceGitHub (xixihhhh/clipforge)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/xixihhhh/clipforge ↗
Everything known
We have not matched this listing to a published package, so we cannot say whether outside reports exist for it. Reports that name its GitHub project would be listed here.
Popularity grade: C (from public signals such as stars and downloads, not a code review). Graded 2026-10-23.
Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-31.
About clipforge
ClipForge is an open-source tool that creates short promotional videos for e-commerce platforms. You upload a product image, and it uses AI to write a sales script, add voiceover and subtitles, and produce a finished video ready for TikTok, Instagram, or other platforms.
Who it’s for
Small business owners, content creators, and e-commerce sellers who want to make product videos quickly without filming or editing skills. It's designed for bulk video creation with minimal cost.
Alternatives
- Synthesia (cloud-based video generation with templates)
- Descript (AI video editor with auto-captioning)
- HeyGen (AI avatar video creation)
- Runway Gen-2 (general AI video generation)
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README at https://github.com/xixihhhh/clipforge (opens external site) for installation. The project appears to be open-source and self-deployed locally, so setup steps will vary based on your system.
Why this grade
Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 1.1k
- Listing last refreshed
- 2026-10-31
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Risks to watch for
- Image manipulation risk: The tool must access and process product images; malformed images could potentially trigger errors or unexpected behavior in the AI processing pipeline.
- AI-generated content accuracy: The AI script writer may create misleading claims about products that you'd need to verify before publishing to avoid false advertising.
- API dependencies: It may rely on external AI services (like speech-to-text or voice generation) that could leak metadata about your products or videos.
- Local file access: As a self-deployed tool, it can read files from your computer; if misconfigured, it could access sensitive business data or customer information.
- Prompt injection via images: Attackers could embed hidden text or patterns in product images to trick the AI into generating inappropriate or promotional content.
How to lower the risk
Least-privilege permissions
- Run the tool in an isolated user account with access only to product images and output folders.
- Don't grant it access to customer databases, payment systems, or personal files.
Network isolation
- Check which external APIs or services it connects to (voice generation, AI models) before running.
- Consider running behind a firewall that logs outgoing connections to detect unexpected data transfer.
Monitoring
- Review every generated video script for false or misleading claims before publishing.
- Log which images were processed and when, to catch unauthorized use.
Red flags to watch for
- Unusually large outbound network traffic or connections to unknown services.
- Generated scripts that make health, legal, or safety claims without your input.
Questions
How do I install clipforge?
We have not matched this listing to a published package. Follow the setup steps in its source repository at github.com/xixihhhh/clipforge.
Are there security reports about clipforge?
We have not matched this listing to a published package, so this page cannot say whether outside reports exist. clipforge currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include image manipulation risk, ai-generated content accuracy, api dependencies.
Is clipforge actively maintained?
clipforge has 1.1k GitHub stars. Our directory data was last refreshed on 2026-10-31. Check recent commit activity, release tags, and open issues at github.com/xixihhhh/clipforge before pinning it in production.
What are alternatives to clipforge?
Compare clipforge side by side with similar MCP servers in the Related tools section on this page, or browse all MCP servers on AgentArmorHQ.
README badge and team notes
Maintain or use clipforge? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/xixihhhh-clipforge)HTML embed:
<a href="https://agentarmorhq.com/skills/xixihhhh-clipforge"><img src="https://agentarmorhq.com/api/badge/xixihhhh-clipforge" alt="AgentArmorHQ Risk Grade for clipforge" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "xixihhhh-clipforge"Share with your security lead
Need sign-off to use clipforge? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: clipforge
- **Listing URL:** https://agentarmorhq.com/skills/xixihhhh-clipforge
- **Type:** App connector
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 1.1k GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** No API token required
- **Package source:** GitHub (xixihhhh/clipforge)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/xixihhhh/clipforge
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 23, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Publisher
- xixihhhh
- Source code
- github.com/xixihhhh/clipforge
- Est. context load
- ~900 tokens / turn (~5 tool schemas, 0.45% of 200k context)
- Popularity
- 1.1k GitHub stars
- Last updated
- 2026-10-31
- Last graded
- 2026-10-23
Community
Discussions for clipforge
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.