Generate images & videos with: Gemini 3 Pro Image + Qwen Wan 2.6 (video) via one API key
PassAudited by ClawScan on May 1, 2026.
Overview
The skill is a coherent media-generation client, but it uses your AIsa API key to send prompts and image URLs to AIsa and may consume paid quota.
This looks appropriate for its stated purpose. Before installing, make sure you trust AIsa and the skill publisher, use a limited/monitored API key where possible, and ask the agent to confirm before creating videos or other requests that could incur cost.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Requests run under the user's AIsa account and may consume quota or paid credits.
The client reads an AIsa API key and sends it as a bearer token to authenticate API calls.
api_key = explicit or os.environ.get("AISA_API_KEY") ... "Authorization": f"Bearer {api_key}"Use a dedicated or limited API key if available, monitor usage, and prefer the environment variable over passing the key on the command line.
Prompts, reference image URLs, and generated-task metadata may leave the local environment and be processed by the provider.
The skill sends user prompts and reference image URLs to AIsa cloud endpoints as part of the generation workflow.
GEMINI_BASE_URL = "https://api.aisa.one/v1" ... VIDEO_BASE_URL = "https://api.aisa.one/apis/v1" ... "prompt": prompt, "img_url": img_url
Avoid sending private, confidential, or rights-sensitive prompts/images unless AIsa's terms and data-handling practices are acceptable.
Users have less provenance information to rely on when deciding whether to trust the skill with an API credential.
The package provenance is not identified beyond the registry metadata, even though the skill asks for a provider API key.
Source: unknown
Verify the publisher, API provider, and code contents before installing or supplying an API key.