Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Wan Video Generation and Editting
v1.0.1Video Generation and Editing with Wan 2.7 series models. Supports text2video, image2video (first-frame, first+last-frame, video-continuation), reference2vide...
⭐ 0· 51·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the implementation: the script calls Wan/DashScope endpoints to create video tasks and query task status. The required credential (DASHSCOPE_API_KEY) aligns with the remote API host. One inconsistency: metadata lists 'requests' as a required binary; in reality 'requests' is a Python package import, not an executable binary.
Instruction Scope
The runtime script encodes local files as data: URIs (base64) and sends them to the remote API. The SKILL.md accepts local paths for frames, clips, and audio — which is reasonable for a media upload tool — but nothing in the documentation restricts which local paths can be supplied. That means an attacker or careless user could cause arbitrary local files (e.g., ~/.ssh/id_rsa or other secrets) to be read, base64-encoded, and uploaded to dashscope.aliyuncs.com. The skill also prints file-size/encoding info to stdout.
Install Mechanism
No install spec or external downloads; the skill is instruction + included script only. This lowers supply-chain risk because nothing is fetched at install time. It does require a Python runtime and the 'requests' library being available.
Credentials
Only one credential is required: DASHSCOPE_API_KEY, which is proportional to an API wrapper for a remote video service. Recommend ensuring the API key has limited scope and billing controls. No other unrelated env vars are requested. Be aware the script will add an Authorization: Bearer header with that key for all requests to the DashScope endpoint.
Persistence & Privilege
The skill does not request permanent/always-on inclusion and does not modify other skills or system configuration. It runs as a one-off CLI wrapper and does not persist new credentials to the system.
What to consider before installing
This skill is mostly coherent for uploading media to Alibaba's Wan/DashScope API, but it can read arbitrary local files and will base64-encode and send them to dashscope.aliyuncs.com. Before installing or running it: 1) Do not pass paths to sensitive files (SSH keys, credentials, private documents) as any media argument. 2) Prefer creating an API key with minimal privileges and billing limits for DASHSCOPE_API_KEY. 3) Inspect or run the included script (scripts/wan27-magic.py) yourself; if you must run it, do so in a restricted environment (container or VM) with only non-sensitive files accessible. 4) Note the minor metadata inconsistency: 'requests' is a Python package (install via pip) not a system binary. 5) If you need guarantees about data handling or retention, ask the provider (dashscope.aliyuncs.com / Alibaba) about how uploaded media and generated results are stored and who can access them.Like a lobster shell, security has layers — review code before you run it.
latestvk973anjp6gn2xsddn1kwzxrkc5841g5t
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
Binspython3, requests
EnvDASHSCOPE_API_KEY
Primary envDASHSCOPE_API_KEY