VoooAI - AI Multimedia NL2Workflow Platform
Analysis
This skill appears to be a coherent VoooAI creative-generation integration, but it will send prompts, uploaded media, and an access key to VoooAI and may consume account credits.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
resp = api_post("/api/node-builder/execute", body, timeout=120) ... if "points_consumed" in resp: out["points_consumed"] = resp["points_consumed"]The skill can submit generated workflows for execution and reports consumed points afterward. This is purpose-aligned, but it can use account credits.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
BASE_URL = os.environ.get("VOOOAI_BASE_URL", "https://voooai.com") ... "Authorization": f"Bearer {access_key}"The scripts send the user's VOOOAI_ACCESS_KEY as a Bearer token to the configured API base URL. This is expected for the integration, but the optional base URL changes where the credential is sent.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
body = {"description": description} ... body["reference_urls"] = reference_urls ... api_post("/api/agent/nl2workflow/generate", body, timeout=120)User descriptions and reference file URLs are sent to VoooAI's backend AI workflow generator. This is central to the skill's purpose, but it is an external data flow.