Sauce Duck Video Maker
AdvisoryAudited by VirusTotal on Mar 29, 2026.
Overview
Type: OpenClaw Skill Name: sauce-duck-videos Version: 1.0.5 The skill is a legitimate integration for the RunningHub platform to generate AI videos. It manages API keys and host configurations locally in the user's home directory (~/.openclaw/openclaw.json) and communicates exclusively with official RunningHub domains (runninghub.cn/ai) via scripts like create_task.py and poll_task.py. No evidence of data exfiltration, unauthorized execution, or malicious prompt injection was found.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent can use the saved RunningHub API key to create and query video-generation tasks on the selected RunningHub host.
The skill asks for a RunningHub API key and saves it for later use. This is expected for the RunningHub integration, but it is credential handling that users should understand before installing.
如果`api_key`的值为空字符串或为 `null`，询问用户输入在`host`网站创建的API Key...调用对应脚本保存`api_key`值
Use a RunningHub key intended for this skill, verify the selected host, and rotate or remove the key if you no longer want the skill to access the account.
A background process may continue polling RunningHub for the task result for a limited time while the video is being generated.
The skill runs a local Python polling script through OpenClaw exec in the background. This is disclosed and aligned with waiting for video generation, but it is still local tool execution.
使用 OpenClaw exec 工具在后台启动视频生成脚本 ... "background": true
Only invoke the skill when you want it to start a RunningHub generation task, and clear or stop the background session if you no longer need it.