llm-video-generator
Security checks across malware telemetry and agentic risk
Overview
The skill matches its stated video-generation purpose, but users should know it uses an undeclared ZhipuAI API key/dependencies and sends prompts or images to ZhipuAI.
This appears suitable for its stated purpose if you intend to use ZhipuAI for video generation. Before installing, make sure you are comfortable providing a ZhipuAI API key, sending prompts/images to that provider, and storing generated task metadata in the chosen output folder.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Using the skill will use the user's ZhipuAI account and may consume quota or incur provider charges.
Core generation requires the user's ZhipuAI API key, even though the registry metadata declares no primary credential or required env vars.
Environment:
ZHIPU_API_KEY Required. ZhipuAI API key.
...
api_key = os.environ.get("ZHIPU_API_KEY")Use a scoped or limited ZhipuAI API key if available, monitor usage/costs, and revoke the key if you no longer use the skill.
Prompts, uploaded images, and continuation frames are processed by an external provider as part of video generation.
For image-based modes, local image files are converted to base64 data URLs and sent with prompts to the ZhipuAI video generation API.
if os.path.isfile(img):
img = image_to_base64_url(img)
...
response = client.videos.generations(
model="cogvideox-3",
prompt=prompt,
image_url=image_url,Avoid using private or sensitive images/prompts unless you are comfortable sending them to ZhipuAI under its terms and retention policies.
Prompt text and result metadata may remain on disk after generation completes.
The script stores generation metadata, including the prompt, in JSON files under the selected output directory.
task_info = {
"task_id": task_id,
"mode": args.mode,
"prompt": args.prompt,
"timestamp": time.strftime("%Y-%m-%d %H:%M:%S"),
}Choose an appropriate output directory and delete task/result JSON files if the prompt or generated video URL is sensitive.
Installation or execution may fail unless the local environment already has the expected Python path, Python packages, and video tools.
The scripts depend on ffmpeg/ffprobe and a ZhipuAI Python client, but the registry metadata lists no required binaries and no install spec.
cmd = [
"ffmpeg", "-y",
"-f", "concat",
"-safe", "0",
"-i", list_path,Before installing, confirm ffmpeg/ffprobe, the ZhipuAI Python client, and /opt/anaconda3/bin/python3 are available, or update the skill metadata/install instructions.