Renderful AI

WarnAudited by ClawScan on May 10, 2026.

Overview

The skill matches its stated Renderful image/video purpose, but it explicitly promotes agent-controlled crypto payments without human approval or spending limits.

Review this skill before use. It is reasonable for Renderful generation, but do not enable autonomous x402 payments unless you are comfortable with the agent spending crypto. Prefer manual approval, a dedicated low-balance wallet, and a revocable API key.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Concern

ASI02: Tool Misuse and Exploitation

What this means

If a wallet is configured, the agent could incur crypto charges for generation requests without asking each time.

Why it was flagged

The skill grants HTTP/curl capability and documents a payment mode where the agent can spend via x402 without a human approval step, but provides no budget, confirmation, or scoping controls.

Skill content

allowed-tools: Bash(curl), Web(fetch) ... # Agent can pay directly without human approval
export RENDERFUL_X402_WALLET="your_agent_wallet"
export RENDERFUL_PREFER_X402="true"

Recommendation

Use manual confirmation for every paid request, set explicit spending limits, and avoid enabling x402 in the agent environment unless using a dedicated low-balance wallet.

Concern

ASI03: Identity and Privilege Abuse

What this means

The agent may be able to use your Renderful account and configured wallet for paid generation if those values are available.

Why it was flagged

The skill requires a service API key and optionally a payment wallet, both of which grant account/payment authority; the artifacts do not define credential scope, rotation, storage, or spending boundaries.

Skill content

export RENDERFUL_API_KEY="rf_your_api_key" ... export RENDERFUL_X402_WALLET="your_agent_wallet"

Recommendation

Use a scoped/revocable API key, keep payment credentials out of broad agent environments, and configure only a dedicated wallet with minimal funds.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users have less registry-provided information to verify who maintains the integration before connecting paid credentials.

Why it was flagged

The registry provenance is incomplete for a skill that asks users to interact with a paid external API and configure credentials or wallet information.

Skill content

Source: unknown
Homepage: none

Recommendation

Independently verify renderful.ai, its dashboard, pricing, and terms before providing an API key or wallet configuration.