gemini-video-understanding

PassAudited by ClawScan on May 10, 2026.

Overview

This skill appears coherent and purpose-aligned, but it requires a Gemini API key and sends selected video content to Google Gemini for analysis.

Install only if you are comfortable providing a Gemini API key and sending the chosen videos or YouTube URLs to Google Gemini. Use non-sensitive test videos first, confirm provider data-handling expectations, and install any required SDK only from trusted sources. This review is based on the supplied artifact text, which was partially truncated.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Requests may use your Gemini account quota, billing, and access permissions.

Why it was flagged

The skill expects a Gemini API key and will make requests under the user's Google/Gemini account. This is expected for the stated API integration, but it is still sensitive delegated authority.

Skill content
client = genai.Client(api_key=os.getenv("GEMINI_API_KEY"))
Recommendation

Use a dedicated or least-privileged API key where possible, monitor usage and billing, and revoke the key if you stop using the skill.

What this means

Selected videos may leave your local device and be processed by Google Gemini.

Why it was flagged

The skill uploads user-selected local videos to the Google Gemini File API for processing. This is central to the stated purpose and disclosed, but video files can contain sensitive people, audio, locations, or business information.

Skill content
Use the File API upload flow for larger videos ... myfile = client.files.upload(file="video.mp4")
Recommendation

Only analyze videos you are allowed to share with the provider, review Google/Gemini data handling terms, and use clipping or lower-scope inputs when possible.

What this means

You may need to install the Gemini SDK yourself, and the provided artifacts do not pin a package version or source.

Why it was flagged

The skill is instruction-only and has no packaged code to run, but SKILL.md references the Google GenAI Python library, so dependency installation and version selection are left to the user.

Skill content
No install spec — this is an instruction-only skill.
Recommendation

Install the official Google GenAI SDK from a trusted package source and consider pinning versions in your own environment.