Skillv1.0.3

ClawScan security

LibTV API Skills · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

BenignMar 18, 2026, 3:42 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's code, runtime instructions, and requested credential (LIBTV_ACCESS_KEY) are consistent with an agent that uploads media, calls liblib.tv/im APIs, polls for results, and downloads generated assets.
Guidance: This skill appears to do what it says: it needs a LIBTV_ACCESS_KEY and python3, uploads files you provide, sends your raw prompts to liblib.tv, polls for results, and downloads generated media to disk. Before installing, confirm you trust the LIBTV_ACCESS_KEY owner (it grants API access to the external liblib.tv service). Be aware the skill writes downloaded files to your filesystem (default ~/Downloads/libtv_results) and will upload any local files you pass to upload_file.py — avoid supplying sensitive media. If you want to restrict network endpoints, note the scripts call im.liblib.tv and download from libtv-res.liblib.art; you can override the base URL with OPENAPI_IM_BASE/IM_BASE_URL if needed. Finally, the SKILL.md instructs the agent to 'auto-download' on completion; the provided scripts do the download but do not chain that automatically — consider whether you want the agent to perform automatic file writes.

Review Dimensions

Purpose & Capability: okName/description (LibTV AI image/video generation) aligns with required binary (python3), required env (LIBTV_ACCESS_KEY), and the scripts which call im.liblib.tv, upload media, query sessions, and download results.
Instruction Scope: noteSKILL.md confines actions to creating sessions, uploading user-provided media, polling, and downloading results. One minor mismatch: the doc says the agent should 'automatically execute download' when generation completes; the provided scripts implement a download utility but do not auto-run from create_session.py — automatic downloading is an agent-level behavior instruction rather than built into the scripts. Also the skill will write files to disk (user-specified or ~/Downloads by default), which is expected but worth noting for privacy/space.
Install Mechanism: okNo install spec; instruction-only plus small Python scripts that use only the standard library. No third-party packages or downloads from untrusted URLs.
Credentials: okOnly LIBTV_ACCESS_KEY is required (primaryEnv). Optional environment variables (OPENAPI_IM_BASE / IM_BASE_URL) are documented. No unrelated credentials or broad environment/config path access are requested.
Persistence & Privilege: okalways:false and default autonomous invocation are appropriate. The skill does not modify other skills or system settings and does not request permanent elevated privileges.