Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Brand Video Maker Skill
v1.0.2Brand Video Maker is an AI tool for replacing logos, packaging, product shots, and brand elements inside existing videos without reshooting. It helps marketi...
⭐ 0· 76·0 current·0 all-time
bywes@imwyvern
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description align with the documented pipeline (frame extraction → AI editing → i2v → assembly). However the SKILL.md explicitly names external tools/models (Gemini, Kling V3 / Seedance) and ffmpeg while the skill declares no required binaries, no credentials, and no primary credential. That mismatch (heavy external/model dependencies but no declared env vars/binaries) is disproportionate and unexplained.
Instruction Scope
The SKILL.md stays on-topic (describes operations on source videos) and does not explicitly instruct reading unrelated system files. It does not, however, specify where processing happens (locally vs uploaded to external APIs), how frames are uploaded, or what endpoints receive user videos, leaving ambiguity about potential data transmission of user media.
Install Mechanism
No install spec and no code files — lowest install risk. Nothing is downloaded or written by the skill itself.
Credentials
The skill references third-party model providers and ffmpeg but requests no environment variables or credentials; this is suspicious because real integrations with Gemini or Kling/Seedance would typically require API keys or service accounts. There is also an external upgrade URL (https://mediaclawbot.com) and a claimed parent (MediaClaw) with no homepage or documented trust signals, increasing uncertainty about where data would be sent.
Persistence & Privilege
The skill does not request always: true and is user-invocable only. There is no indication it would modify other skills or system-wide agent settings.
What to consider before installing
This skill plausibly describes video-brand-replacement, but it leaves key details unspecified. Before installing or using it, ask: (1) Where does the processing occur — locally or uploaded to an external API? (2) If external, what endpoints and privacy/retention policies apply? (3) Which binaries or API keys are required (ffmpeg, Gemini, Kling/Seedance) and why aren't they declared? (4) Who operates mediaclawbot.com / MediaClaw and is there a trustworthy privacy/legal policy for handling source videos? If you must process sensitive videos, don't upload them until you have explicit documentation of endpoints, required credentials, and a privacy/security policy.Like a lobster shell, security has layers — review code before you run it.
latestvk970jy1jevhya2wxny6b9hsnen83wvst
License
MIT-0
Free to use, modify, and redistribute. No attribution required.