Bona Movie Production
Analysis
This appears to be a straightforward Bona API client for image and video generation, but users should notice that it needs a Bona API key and sends prompts or media references to Bona’s remote service.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
Required env vars: none ... Primary credential: none ... No install spec — this is an instruction-only skill.
The registry metadata under-declares setup needs compared with SKILL.md and code, which reference requests and BONA_API_KEY. This is a disclosure/setup gap rather than evidence of hidden behavior.
PROCESSING_STATUSES = {0, "0", ...}; SUCCESS_STATUSES = {1, "1", ...}; FAILED_STATUSES = {2, "2", 3, "3", ...}The visible code treats status 1 as success, while SKILL.md describes status 9 as complete, -1 as failed, and 1 as still generating. This could make task polling unreliable.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
DEFAULT_LOGIN_URL = "https://create.bonanai.com/api/auth/loginByAccessKey" ... json={"accessKey": self.api_key}The client logs in to Bona using an API key and then uses a bearer token for generation requests. This is expected for the stated service, but it is still account-authorized access.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
requests.post(f"{self.base_url}/image", headers=self.headers, json=payload, timeout=self.timeout) ... requests.post(f"{self.base_url}/video", headers=self.headers, json=payload, timeout=self.timeout)Image and video prompts, plus any reference media URLs included in the payload, are sent to a remote Bona API. This is purpose-aligned, but it is an external data flow.