Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
WaveSpeedAI Watermark Remover
v1.0.0Remove watermarks, logos, captions, and text overlays from images and videos using WaveSpeed AI. Intelligently detects and removes watermarks while preservin...
⭐ 0· 442·2 current·2 all-time
byC@chengzeyi
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name and description match the SKILL.md instructions: it calls out image/video watermark removal via a WaveSpeed AI service. However the skill metadata declares no required environment variables or dependencies while the instructions explicitly require a WAVESPEED_API_KEY and import a 'wavespeed' client library — this mismatch suggests the registry metadata is incomplete.
Instruction Scope
The SKILL.md directs the agent to upload local media files and call a remote 'wavespeed' service using an API key. It does not instruct reading unrelated system files, but it does reference a local file upload flow and an environment variable (WAVESPEED_API_KEY) that are not declared in the registry metadata. The instructions also accept arbitrary URLs (with a security note advising against untrusted URLs) — the agent will need to access local files and external network endpoints, which is expected for this functionality but should be explicit in metadata.
Install Mechanism
There is no install spec (instruction-only), which is low risk. However the SKILL.md example imports a 'wavespeed' JS package and uses a Client API, but the skill does not declare that dependency or provide installation instructions. That omission is an inconsistency: the runtime will need that client library available but the skill gives no guidance on obtaining it.
Credentials
The SKILL.md requires a WAVESPEED_API_KEY for authentication (and shows how to export it), but the registry metadata lists no required environment variables or primary credential. Requesting one service API key is proportionate to the stated purpose, but the missing declaration in metadata is a meaningful discrepancy. There are no other unrelated credentials requested.
Persistence & Privilege
The skill does not request persistent presence (always is false), does not modify other skills or system config, and does not declare privileged config paths. Autonomous invocation is allowed (default) but is not combined with other alarming privileges.
What to consider before installing
This skill appears to do what it says (call a WaveSpeed API to remove watermarks), but the package metadata is incomplete: SKILL.md requires WAVESPEED_API_KEY and a 'wavespeed' client library while the registry entry lists no env vars or dependencies. Before installing, ask the publisher for: (1) a homepage or source repo to verify provenance; (2) explicit dependency/install instructions for the 'wavespeed' SDK; and (3) updated metadata declaring WAVESPEED_API_KEY as a required credential. Only provide an API key you trust to this third-party service and avoid hardcoding it — use a secret manager or per-project key. Test with non-sensitive media first, review the network endpoints the client uses, and consider legal/ethical implications of removing watermarks on copyrighted content.Like a lobster shell, security has layers — review code before you run it.
latestvk975bppnt2qdst4rdwashcgznh825md9
License
MIT-0
Free to use, modify, and redistribute. No attribution required.