ClawVideo Generation
PassAudited by ClawScan on May 1, 2026.
Overview
This skill coherently generates videos through JSON2Video, but users should notice that it needs a JSON2Video API key, sends video content to an external service, and may consume service credits.
This appears safe to use for its stated purpose if you are comfortable providing a JSON2Video API key and sending your video configuration to JSON2Video. Before running it, review the config for private content, understand possible credit costs, and keep the API key in an environment variable rather than in files.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Running the skill can spend credits in the connected JSON2Video account.
The skill can submit render jobs that consume JSON2Video credits. This is disclosed and purpose-aligned, but users should intentionally approve costly or batch video generation.
Expected Costs: - Simple video (3 scenes, TTS, subtitles): ~50-100 credits - Complex video (5 scenes, AI images, TTS): ~150-250 credits
Review the video configuration, quality settings, and batch size before running; start with small test renders.
The skill acts with the authority of the provided JSON2Video API key when creating or checking video render jobs.
The skill requires an account API key for JSON2Video. This is expected for the integration, but the registry metadata lists no required environment variables or primary credential.
API key must be set as environment variable `JSON2VIDEO_API_KEY`
Use a JSON2Video key with the minimum needed access, keep it out of files, and remove or rotate it if it is no longer needed.
Any sensitive text, prompts, image URLs, or audio URLs included in the configuration may be processed by the external provider.
The script sends the video payload to JSON2Video. That is necessary for the service, but it means prompts, voiceover text, media URLs, and related configuration leave the local environment.
API_BASE = "https://api.json2video.com/v2" ... response = requests.post(url, headers=headers, json=payload)
Do not include secrets or private assets in video configs, and review JSON2Video's privacy, retention, and caching behavior before using sensitive content.
Users have less provenance information to rely on when deciding whether to run the included helper script.
The artifact set has limited upstream provenance and includes a Python helper script without a formal install/dependency specification. This is not suspicious by itself, but it is a supply-chain notice for code execution.
Source: unknown Homepage: none No install spec — this is an instruction-only skill.
Review the included script before use, run it in a normal least-privilege environment, and install any dependencies deliberately from trusted sources.