Scene Video Generator

Security checks across malware telemetry and agentic risk

Overview

This instruction-only skill is coherent for generating AI video clips, but it may use third-party video services with API keys and may send prompts or reference images to those services.

This skill appears safe to install as an instruction-only video-generation helper. Before using it, decide which backend you trust, protect any API keys, set quota or spending limits if possible, and avoid sending sensitive images or confidential prompts to third-party video services.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI03: Identity and Privilege Abuse
Low
What this means

If configured, the agent may be able to submit generation jobs using the user's provider account and consume credits or quota.

Why it was flagged

The skill documentation shows configuration of third-party provider credentials. This is expected for video-generation backends, but those keys can grant access to paid provider accounts.

Skill content
"kling": { "access_key": "your_access_key", "secret_key": "your_secret_key" }
Recommendation

Use provider-specific keys with the least needed permissions, set spending/quota limits where available, and avoid pasting real secrets into chat transcripts or shared documents.

#
ASI07: Insecure Inter-Agent Communication
Low
What this means

Prompts, scene descriptions, and uploaded reference images may be processed by third-party AI video services.

Why it was flagged

The workflow explicitly sends optional reference images and prompts to external image-to-video or text-to-video APIs. This is purpose-aligned, but the artifacts do not specify provider retention or privacy boundaries.

Skill content
上传参考图
  ↓
调用 image-to-video API
  ↓
输出: 视频 URL
Recommendation

Do not use sensitive, private, or confidential images/prompts unless the selected provider's privacy and retention terms are acceptable.