Explainer Video Guide

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only video guide is coherent, but it relies on installing and logging into an external inference.sh CLI and sending generation inputs to remote providers.

Install only if you trust inference.sh, verify the installer/checksum, understand that infsh login may use your account quota, and avoid sending confidential scripts or media to remote generation providers unless that is acceptable.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

You would be trusting an external installer and downloaded binary before using the video-generation workflow.

Why it was flagged

The guide asks users to install a third-party CLI by piping a remote script into the shell; this is disclosed and central to the skill, but the installer is outside the provided artifacts.

Skill content
curl -fsSL https://cli.inference.sh | sh && infsh login
Recommendation

Verify the inference.sh domain and checksum information, and install only if you trust that provider.

What this means

When used, the skill may run infsh commands that create media jobs and may consume service credits or account quota.

Why it was flagged

The skill gives the agent a scoped Bash capability for infsh commands, which fits the stated video-generation purpose but can initiate external generation jobs.

Skill content
allowed-tools: Bash(infsh *)
Recommendation

Review generated prompts, inputs, and expected provider costs before allowing infsh jobs to run.

What this means

The CLI may use your inference.sh account session to run jobs or access provider services.

Why it was flagged

The workflow uses an external service login, which is expected for inference.sh access but creates delegated account access for the CLI.

Skill content
infsh login
Recommendation

Use an account and permissions appropriate for media generation, and revoke or log out if you no longer use the skill.

What this means

Product scripts, prompts, and image assets used with the commands may be transmitted to external services.

Why it was flagged

The examples send prompts and optional media inputs to remote generation apps through inference.sh providers.

Skill content
infsh app run falai/wan-2-5-i2v --input '{ ... "image": "path/to/workspace-still.png" }'
Recommendation

Avoid sending confidential scripts, unreleased product details, or private media unless the provider terms and account settings are acceptable.