LrshuAI First Tail Frame To Video
PassAudited by ClawScan on May 10, 2026.
Overview
This skill appears to do what it says—run a Python helper to send user-selected first and last frames to a video-generation API—but it uses your TEAM_API_KEY and uploads media to the configured endpoint.
Use this skill only if you trust the API endpoint and are comfortable uploading the selected images or videos. Confirm TEAM_API_KEY and any TEAM_BASE_URL value are meant for this service, and avoid using highly sensitive media unless the provider’s privacy terms are acceptable.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill will run local code when invoked, rather than relying on the standard `openclaw run` path.
The skill directs the agent to execute a local Python script directly. The bundled code is visible and aligned with the stated purpose, so this is a notice rather than a concern.
你**绝对不能**使用 `openclaw run`。你**必须**直接通过系统自带的 `python` 命令来运行 `script/invoke_model.py`。
Review the included script before use and invoke it only with the model and file arguments you intend.
Anyone using the skill must provide an API key that authorizes requests to the configured service.
The skill uses the TEAM_API_KEY environment variable as a bearer token for the API request. This is expected for an authenticated model-provider integration.
api_key = os.getenv('TEAM_API_KEY') ... "Authorization": f"Bearer {api_key}"Use a scoped key if available, avoid sharing logs containing credentials, and confirm the key is intended for this provider.
Private images, videos, and prompts provided to the skill may be transmitted to the configured API provider.
The script base64-encodes selected local media and sends it with the prompt to an external or configured API endpoint. This is purpose-aligned for video generation but is a sensitive data flow.
base_url = os.getenv('TEAM_BASE_URL', 'https://dlazy.com/api/ai/tool') ... image_val = f"data:{mime_type};base64,{b64_data}" ... response = requests.post(endpoint, headers=headers, json=payload)Only provide media you are comfortable uploading, and verify TEAM_BASE_URL is unset or points to a trusted endpoint.