Dream Head Tail to Video

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill appears purpose-aligned for generating videos, but it requires a DreamAPI key and sends prompts/images to an external provider.

This skill is reasonable to install if you intend to use DreamAPI/NewportAI for video generation. Before configuring it, confirm the provider and publisher, use a limited or dedicated API key, and do not upload sensitive images or prompts unless you accept the provider’s data practices.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anyone using the skill grants it access to their DreamAPI account or credits for this provider.

Why it was flagged

The skill requires a DreamAPI credential and instructs the user to store it in OpenClaw configuration.

Skill content
requires: {"env": ["DREAMHEADTAILTOVIDEO_API_KEY"]} ... openclaw config patch --json ... "DREAMHEADTAILTOVIDEO_API_KEY": "your-api-key-here"
Recommendation

Use a dedicated API key if possible, monitor usage, and revoke or rotate the key if you stop using the skill.

What this means

Prompts and image content may leave the local environment and be processed or stored by the external provider.

Why it was flagged

The documented workflow uploads first and last frame images and sends generation requests to an external API provider.

Skill content
Upload your local files to OSS first ... POST https://api.newportai.com/api/async/wan/head_tail_to_video/2.1
Recommendation

Avoid using sensitive, private, or regulated images unless you trust the provider’s data handling and retention practices.

What this means

Users have less provenance information for confirming who published the skill before trusting it with an API key.

Why it was flagged

The registry information does not identify a source repository or homepage for verifying that the skill is maintained by the referenced provider.

Skill content
Source: unknown; Homepage: none
Recommendation

Verify the API documentation and publisher identity independently before configuring credentials.