AI Media Generation En
PassAudited by ClawScan on May 1, 2026.
Overview
The skill appears to do what it says—call AIsa to generate images and videos—but it uses an API key and sends prompts or reference image URLs to that provider.
Before installing, confirm you trust the publisher and AIsa service, use a controlled API key, avoid sensitive prompts or private image URLs, and choose output paths carefully when downloading generated media.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone using the skill should understand that generated media requests may consume quota or create charges on the AIsa account tied to the key.
The client reads the AIsa API key and sends it as a bearer token to the configured AIsa API requests. This is expected for the stated service integration, but it grants provider account access and may incur usage charges.
api_key = explicit or os.environ.get("AISA_API_KEY") ... "Authorization": f"Bearer {api_key}"Use a dedicated or limited-scope AIsa key if available, keep the key out of shared logs, and monitor provider usage and billing.
Prompts and referenced image URLs may be processed by the AIsa service, so sensitive or private content could leave the local environment.
The skill sends user prompts and video reference image URLs to the external AIsa endpoints for generation. This is central to the skill's purpose and is disclosed, but it is still an external data flow.
body = {"contents": [{"role": "user", "parts": [{"text": prompt}]}]} ... "input": {"prompt": prompt, "img_url": img_url}Avoid submitting secrets, confidential business material, or private image URLs unless AIsa's privacy and retention terms are acceptable.
Users have less publisher provenance to rely on when deciding whether to trust the API integration.
The package source is not identified in the provided metadata. The artifacts do include the client script and no remote install step is shown, so this is a provenance note rather than evidence of malicious behavior.
Source: unknown
Install only if you trust the publisher or have reviewed the bundled script and provider endpoints.