Video Captioning by ReelWords

PassAudited by ClawScan on May 1, 2026.

Overview

The skill coherently uses ReelWords to caption videos and shows no hidden or purpose-mismatched behavior, but it does require an API key and sends video job data to an external service.

This appears safe to install if you trust ReelWords and are comfortable sending your video URLs and caption preferences to its API. Keep the API key private, monitor account usage or credits, review the included Python helper before running it, and choose a non-sensitive output path for downloaded videos.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Your ReelWords API key may be used to create caption jobs, retrieve job status, download outputs, and potentially consume credits.

Why it was flagged

The skill needs a ReelWords API key to create and retrieve caption jobs. This is expected for the service, but it gives the agent account-backed API authority when invoked.

Skill content
Provide the API key to the process as `REELWORDS_API_KEY`... Auth header is `x-api-key: <token>`.
Recommendation

Use a dedicated or limited ReelWords key if available, store it securely, monitor usage, and rotate the key if it is exposed.

What this means

Video URLs and caption job metadata leave your local environment and are processed by ReelWords.

Why it was flagged

The skill clearly discloses that video URLs, caption preferences, and result links are exchanged with the ReelWords API.

Skill content
Base URL: `https://api.reelwords.ai`... `videoUrl` (required)... `result.downloadUrl`
Recommendation

Only use video URLs and content you are comfortable sharing with ReelWords, and treat returned signed download URLs as potentially sensitive.

What this means

You have less external provenance information for the skill package, even though the provided helper code is reviewable.

Why it was flagged

The skill includes local helper code but does not provide a source repository or homepage. The included code is visible and no remote install is instructed, so this is a provenance note rather than a concern.

Skill content
Source: unknown; Homepage: none; No install spec — this is an instruction-only skill.
Recommendation

Review the included script before running it and obtain any needed Python dependencies from trusted sources.

What this means

If an existing file path is chosen for output, the helper may overwrite it with the downloaded video.

Why it was flagged

The helper can write a downloaded video to a user-specified local path. This is purpose-aligned and user-directed, but users should choose the output path carefully.

Skill content
p.add_argument("--out", default=None, help="If set, download the rendered video to this path")... with open(out_path, "wb") as f:
Recommendation

Use a safe, explicit output filename and avoid pointing `--out` at important existing files.