Vidu official video generation. Image to video / Text to video / Reference to video / Text to image / Reference to image / Video edit / Image edit

AdvisoryAudited by Static analysis on May 5, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing the skill requires trusting the vidu-cli package and its downloaded binary before giving it your Vidu token.

Why it was flagged

The skill depends on an external npm package and a downloaded binary that were not included in the provided artifacts for static review.

Skill content
Install vidu-cli via npm (requires Node.js >=14; postinstall downloads a platform binary from GitHub)
Recommendation

Install vidu-cli only from a trusted source, consider pinning a known version, and use it on a machine where you are comfortable storing the Vidu token.

What this means

The agent can use the configured Vidu account to submit tasks, check quota/credits, and access generated results.

Why it was flagged

The CLI needs an authenticated Vidu token, which is expected for the integration but gives the tool account-level API access.

Skill content
`VIDU_TOKEN` (required) — Vidu API token
Recommendation

Use a revocable token, avoid sharing it in prompts or logs, and rotate it if you no longer trust the environment.

What this means

Generated media jobs may use subscription quota or credits if the agent submits them.

Why it was flagged

Task submissions can consume daily quota or paid credits, and the schedule mode may be selected automatically.

Skill content
`schedule_mode` / `--schedule-mode`: `claw_pass` (daily quota) or `normal` (credits). Optional — if omitted, auto-detected by querying claw-pass status
Recommendation

Confirm the prompt, inputs, duration, resolution, and schedule mode before submitting tasks; use the cost-estimation commands for expensive jobs.

What this means

Private images, videos, audio, or subtitle files selected for a task may be sent to the Vidu service.

Why it was flagged

The skill explicitly uploads local media files to Vidu as part of image/video generation and reference creation.

Skill content
`--image` (`task submit`, `element create`):
- Local path → auto-upload
Recommendation

Review file paths before running commands and avoid uploading sensitive media unless you accept Vidu's handling and retention terms.

What this means

Media saved as reference elements may remain available in the user's Vidu account beyond the current task.

Why it was flagged

Created reference elements are persistent Vidu-side materials that can be reused later.

Skill content
`element create` saves a reference for **future reuse** across multiple tasks.
Recommendation

Create reference elements only when you want persistent reuse, and manage or remove saved materials through Vidu if they are no longer needed.