Wan Image and Video Generation and Editting

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

When invoked, the skill can use the configured DashScope account, which may consume quota or incur service charges.

Why it was flagged

The script reads the DashScope API key from the environment and uses it as a bearer token for API requests.

Skill content

api_key = os.environ.get("DASHSCOPE_API_KEY") ... "Authorization": f"Bearer {api_key}"

Recommendation

Use a dedicated DashScope API key with the minimum needed permissions, keep it out of shared logs, and monitor account usage or billing.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Any local images or media references you provide may be transmitted to Alibaba’s DashScope service for processing.

Why it was flagged

Local image files supplied to the script are encoded and included in requests sent to the external DashScope API.

Skill content

with open(abs_path, "rb") as f: b64 = base64.b64encode(f.read()).decode("utf-8") ... requests.post(url, headers=headers, json=payload

Recommendation

Only provide files you are allowed to upload, avoid sensitive personal or confidential media, and review the provider’s data handling terms.