Dream Head Tail to Video

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anyone using the skill grants it access to their DreamAPI account or credits for this provider.

Why it was flagged

The skill requires a DreamAPI credential and instructs the user to store it in OpenClaw configuration.

Skill content
requires: {"env": ["DREAMHEADTAILTOVIDEO_API_KEY"]} ... openclaw config patch --json ... "DREAMHEADTAILTOVIDEO_API_KEY": "your-api-key-here"
Recommendation

Use a dedicated API key if possible, monitor usage, and revoke or rotate the key if you stop using the skill.

What this means

Prompts and image content may leave the local environment and be processed or stored by the external provider.

Why it was flagged

The documented workflow uploads first and last frame images and sends generation requests to an external API provider.

Skill content
Upload your local files to OSS first ... POST https://api.newportai.com/api/async/wan/head_tail_to_video/2.1
Recommendation

Avoid using sensitive, private, or regulated images unless you trust the provider’s data handling and retention practices.

What this means

Users have less provenance information for confirming who published the skill before trusting it with an API key.

Why it was flagged

The registry information does not identify a source repository or homepage for verifying that the skill is maintained by the referenced provider.

Skill content
Source: unknown; Homepage: none
Recommendation

Verify the API documentation and publisher identity independently before configuring credentials.