Unified API for powerful image and video generation
PassAudited by ClawScan on May 1, 2026.
Overview
This skill appears to do what it says: use an AIsa API key to generate images or videos, send prompts/image URLs to AIsa, and save generated media locally.
Before installing, make sure you trust AIsa and the skill publisher, use a revocable AISA_API_KEY, avoid sending sensitive prompts or private image URLs unless intended, and choose output paths carefully when saving generated files.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Generated media can be saved or overwritten at the chosen local path, and the tool fetches video files from URLs returned by the external service.
The client can download a provider-returned video URL and write it to a local output path when the user chooses the download workflow.
with urllib.request.urlopen(req, timeout=timeout_s) as resp, open(out_path, "wb") as f:
Use explicit, non-sensitive output paths and only enable video download when you expect a generated media file.
Anyone with access to the API key may be able to use the associated AIsa account quota or permissions.
The skill uses an AIsa API credential, either from the environment or an explicit command-line option, to authenticate requests.
api_key = explicit or os.environ.get("AISA_API_KEY")Prefer the environment variable over command-line secrets, use a scoped or revocable key if available, and rotate the key if it may have been exposed.
You have less provenance information than you would with a verified source repository, even though the visible artifacts are coherent.
The registry information does not identify a source repository or verified upstream provenance for the skill.
Source: unknown
Review the included script and install only if you trust the publisher and the AIsa service endpoint.