Generate images & videos with: Gemini 3 Pro Image (image) + Qwen Wan 2.6 (video) via one API key

PassAudited by ClawScan on May 1, 2026.

Overview

This skill coherently uses your AIsa API key to generate images or videos through disclosed AIsa endpoints and save results locally.

This appears purpose-aligned for generating media through AIsa. Before installing, make sure you trust the unknown-source skill enough to use an AIsa key, use a limited/revocable key if possible, and choose safe output paths for downloaded images or videos.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Requests made through the skill will use your AIsa account key and may consume quota or incur provider-side usage.

Why it was flagged

The client uses the user's AIsa API key as a bearer token for provider API calls. This is expected for the stated service, but it is still delegated account/billing authority.

Skill content

api_key = explicit or os.environ.get("AISA_API_KEY") ... "Authorization": f"Bearer {api_key}"

Recommendation

Use a dedicated, revocable API key with appropriate limits, and avoid putting unrelated secrets or sensitive private content in prompts.

Note

ASI02: Tool Misuse and Exploitation

What this means

The skill can create or overwrite local media output files when you run the documented commands.

Why it was flagged

The skill exposes user-directed local commands that can download generated media and write it to a specified output path. This is aligned with the purpose, but users should control output paths and downloads.

Skill content

python3 {baseDir}/scripts/media_gen_client.py video-wait --task-id YOUR_TASK_ID --download --out out.mp4

Recommendation

Use safe output filenames and confirm before downloading or overwriting important files.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

You have less metadata-based assurance about who maintains the skill or where it originated.

Why it was flagged

The registry metadata does not identify a verified upstream source. This is a provenance notice rather than evidence of malicious behavior.

Skill content

Source: unknown

Recommendation

Review the included script before using it with a real API key, and prefer a limited or revocable key.