shorts-generator

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

You may need to provide API keys or subscriptions for media providers, which could allow the skill or agent to use paid third-party services on your behalf.

Why it was flagged

The skill expects possible third-party API keys or subscriptions for asset sourcing. This is aligned with video generation, but users should notice credential use because the registry metadata declares no required environment variables or primary credential.

Skill content

type AssetSource =
  | { type: 'pexels'; apiKey: string }
  | { type: 'pixabay'; apiKey: string }
  | { type: 'unsplash'; apiKey: string }
  | { type: 'storyblocks'; subscription: string }

Recommendation

Use provider keys with the narrowest available scope, monitor usage, and avoid giving credentials unless you explicitly request features that need them.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Text, audio, or video content used for generation could be processed by selected third-party services.

Why it was flagged

The workflow may use external voice providers to synthesize audio from generated scripts. This is expected for a video generator, but it means script text and related content may cross provider boundaries.

Skill content

voiceProvider: 'elevenlabs' | 'edge-tts' | 'openai';
...
const audio = await this.synthesizeVoiceover(script, params.voiceProvider);

Recommendation

Do not submit confidential scripts, private media, or sensitive personal information unless you trust the chosen provider and understand its data policy.