Mosaic Video Editor
v1.3.0AI-powered video editing via the Mosaic API. Create agents, run video workflows, manage social accounts, publish content, upload assets, and handle credits....
⭐ 0· 101·0 current·0 all-time
byKyle Wade@kyle1373
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match required resources and actions: the skill calls Mosaic API endpoints, lists node types, runs agents, uploads assets, publishes to social platforms, and manages credits. Requesting a single MOSAIC_API_KEY is appropriate for this purpose and no unrelated credentials or binaries are requested.
Instruction Scope
SKILL.md contains concrete API call instructions and endpoint references for agent runs, uploads, social publishing, and billing. It stays within Mosaic API scope. Two items to note: (1) it instructs the agent to ask the user for an API key if not present and to 'store the key as MOSAIC_API_KEY in your environment for future sessions', which implies persisting secrets across sessions; (2) it prescribes flows that can change billing state (POST /plan/upgrade and POST /credits/settings) and publish to social accounts — these are expected for the skill but have real-world side effects and require explicit user consent.
Install Mechanism
No install spec and no code files to execute; this is an instruction-only skill (lowest install risk). All behavior is driven by runtime HTTP calls described in the SKILL.md and manifest docs.
Credentials
Only MOSAIC_API_KEY is required (primary credential), which is proportional to a Mosaic API integration. The instruction to persist the key in the environment is a user-interface/design decision rather than a technical need; users should be aware persisting keys may expose them to other skills or sessions if environment storage is shared.
Persistence & Privilege
always:false (normal). The skill can be invoked autonomously (disable-model-invocation:false) which is the platform default. Combined with the ability to upgrade plans, enable auto top-ups, and publish to social accounts, autonomous operation could perform actions with financial or reputational consequences — this is expected functionality but worth explicit user controls/consent.
Scan Findings in Context
[no_regex_findings] expected: The regex-based scanner reported nothing; the skill is instruction-only and contains no executable code files for the scanner to analyze. This absence of findings is not evidence of safety — review the SKILL.md behavior (billing, key persistence, social publishing).
Assessment
This skill appears to be what it says: a Mosaic API integration that needs your MOSAIC_API_KEY. Before installing or enabling it: (1) only provide a Mosaic API key you trust and be aware the SKILL.md asks the agent to persist that key in the environment — confirm how and where keys are stored in your agent runtime; (2) the skill can initiate billing flows (plan upgrades and auto top-ups) and publish to social accounts — do not allow or automate those actions unless you explicitly approve each operation; (3) consider restricting autonomous invocation if you do not want the agent to perform upgrades or publish without manual confirmation; (4) verify the homepage (https://edit.mosaic.so) and that you trust the skill source/owner before sharing credentials. If you want higher assurance, ask the skill author for a signed provenance or an official Mosaic maintainer confirmation.Like a lobster shell, security has layers — review code before you run it.
latestvk97fdsh63vxnrk21kc8wxtrm8x83mdh8
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
EnvMOSAIC_API_KEY
Primary envMOSAIC_API_KEY