AI Notes Video

PassAudited by ClawScan on May 1, 2026.

Overview

The skill coherently uses Baidu to generate notes from a user-provided video URL, but users should notice that it needs a Baidu API key, shares the video URL with Baidu, and has incomplete setup metadata.

Use this skill only with video URLs you are allowed to share with Baidu, configure a limited Baidu API key where possible, and manually ensure the Python requests dependency is available because the registry metadata does not fully declare the setup requirements.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill can use the configured Baidu API credential and may consume that account's API quota or access rights for this notes workflow.

Why it was flagged

The script reads a Baidu API key from the environment and uses it as a bearer token for the Baidu API.

Skill content

api_key = os.getenv("BAIDU_API_KEY") ... "Authorization": "Bearer %s" % api_key

Recommendation

Use a Baidu API key intended for this purpose, avoid sharing broad or production credentials, and rotate or revoke the key if it is no longer needed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Baidu receives the video URL and may access or process the linked video content.

Why it was flagged

The user-provided video URL is sent to Baidu's Qianfan API so Baidu can create the AI notes task.

Skill content

url = "https://qianfan.baidubce.com/v2/tools/ai_note/task_create" ... params = { "url": video_url } ... requests.post(url, headers=headers, json=params)

Recommendation

Only submit video URLs that you are comfortable sharing with Baidu, especially if the URL is private, signed, or points to confidential content.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may fail or ask for credentials/dependencies that were not surfaced in the registry metadata.

Why it was flagged

The registry metadata under-declares setup requirements because SKILL.md and the scripts require Python and BAIDU_API_KEY, and the scripts import the requests package.

Skill content

Required binaries (all must exist): none ... Required env vars: none ... Primary credential: none

Recommendation

Before use, verify that Python, the requests package, and BAIDU_API_KEY are intentionally configured in the runtime environment.