Wan Image and Video Generation and Editting

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a coherent Wan/DashScope media-generation skill, but it uses your DashScope API key and can send selected local images or media prompts to Alibaba’s API.

Before installing, confirm you are comfortable giving this skill access to a DashScope API key and sending selected prompts/images/videos to Alibaba’s model service. Use a dedicated key, watch quota or billing, and avoid uploading sensitive or unauthorized media.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

When invoked, the skill can use the configured DashScope account, which may consume quota or incur service charges.

Why it was flagged

The script reads the DashScope API key from the environment and uses it as a bearer token for API requests.

Skill content

api_key = os.environ.get("DASHSCOPE_API_KEY") ... "Authorization": f"Bearer {api_key}"

Recommendation

Use a dedicated DashScope API key with the minimum needed permissions, keep it out of shared logs, and monitor account usage or billing.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Any local images or media references you provide may be transmitted to Alibaba’s DashScope service for processing.

Why it was flagged

Local image files supplied to the script are encoded and included in requests sent to the external DashScope API.

Skill content

with open(abs_path, "rb") as f: b64 = base64.b64encode(f.read()).decode("utf-8") ... requests.post(url, headers=headers, json=payload

Recommendation

Only provide files you are allowed to upload, avoid sensitive personal or confidential media, and review the provider’s data handling terms.