AI Notes of Video
Analysis
This skill appears to do what it claims—send a user-provided video URL to Baidu to generate notes—but users should notice that it uses a Baidu API key and an external Baidu service.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
Required binaries (all must exist): none ... Required env vars: none ... Primary credential: none
The registry metadata omits requirements that are present in SKILL.md and the scripts, namely Python execution and BAIDU_API_KEY. This is a transparency/setup issue rather than evidence of malicious behavior.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
api_key = os.getenv("BAIDU_API_KEY") ... "Authorization": "Bearer %s" % api_keyThe script reads a local Baidu API key and sends it as a bearer token to Baidu. This is expected for the service integration, but it is still credential-backed account access.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
url = "https://qianfan.baidubce.com/v2/tools/ai_note/task_create" ... params = { "url": video_url } ... requests.post(url, headers=headers, json=params)The user-provided video URL is transmitted to Baidu's external API for processing, which matches the stated purpose but creates a third-party data flow.