AI Short Video Script Generator Pro
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The script generator mostly matches its purpose, but its code has under-disclosed billing behavior, hard-coded service secrets, and unsafe web-app settings that should be reviewed before use.
Do not run this as-is on a shared or network-accessible machine. Before installing, confirm the billing rules, ask the publisher to remove hard-coded secrets, disable Flask debug/network exposure, and avoid entering confidential topics unless you are comfortable with them being sent to the external AI provider.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user could be billed at unexpected times or under pricing rules that do not match the skill description.
The billing API is called for any non-exempt endpoint, not just an explicit generation action, and the amount in code differs from the advertised $0.005 per generation.
@app.before_request
def check_payment():
if not TEST_MODE and request.endpoint not in ['index', 'pay', 'static'] ...:
charge_result = charge_user(user_id)
...
"amount": 0.001Move charging to the explicit generate action, require clear user confirmation, align the amount with the advertised price, and implement or remove the lifetime-access claim.
Hard-coded secrets can be reused or leaked, and the public Flask secret weakens session integrity if the app is exposed.
The skill embeds payment/model API credentials and a static Flask session secret directly in distributed source code, with no declared credential contract.
app.config['SECRET_KEY'] = 'short-script-secret-key-2026' SKILLPAY_API_KEY = 'sk_...' SILICONFLOW_API_KEY = 'sk-...'
Rotate these keys, remove them from source, use declared environment variables or a secure secret store, and use a unique random Flask secret per deployment.
If the app is run directly, other devices on the network may be able to interact with a debug web server and potentially compromise the local app environment.
Running a Flask development server with debug mode enabled on all interfaces can expose debugger behavior and sensitive stack traces to the local network.
if __name__ == '__main__':
init_db()
app.run(host='0.0.0.0', port=5003, debug=True)Set debug=False, bind to 127.0.0.1 by default, and use a production-safe server configuration if network access is required.
A crafted topic or model output could run JavaScript in the local web UI, affecting saved scripts or the payment/session flow.
User-entered and AI-generated script fields are inserted into the page with innerHTML rather than escaped text rendering.
item.innerHTML = `
<strong>${script.topic}</strong><br>
...
result.innerHTML = `
... <p>${script.hook}</p> ... ${shot.description} ...`Render dynamic content with textContent or a trusted templating/sanitization library, and avoid inserting untrusted model output as HTML.
Topics entered into the tool may be shared with the external model provider.
The user’s topic, platform, and duration are placed into a prompt and sent to an external AI provider.
SILICONFLOW_API_URL = 'https://api.siliconflow.cn/v1/chat/completions'
...
'messages': [{'role': 'user', 'content': prompt}]Disclose the AI provider clearly and avoid entering sensitive or confidential topics unless the provider’s privacy terms are acceptable.
Generated content remains stored locally until deleted, which may matter if topics are private.
Generated scripts and topics are persisted in a local SQLite database as part of the script-library feature.
app.config['DATABASE'] = os.path.join(SKILL_ROOT, 'data', 'scripts.db') ... INSERT INTO scripts (... topic, platform, duration, hook, shots, voiceover, subtitle, bgm, cta)
Use the delete feature for sensitive scripts and ensure the local data directory is protected or cleared when no longer needed.
Users may need to install dependencies manually without pinned versions or provenance guidance.
The app requires Python packages, but the skill has no install spec or dependency lock in the provided artifacts.
from flask import Flask, render_template, request, jsonify, session, redirect, url_for ... import requests
Provide a clear install spec or requirements/lock file with pinned dependency versions.