Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Veteran Entrepreneur Video
v1.0.2AI video creation for veteran entrepreneurs, wealth management practices, independent financial planners, and registered investment advisors — generate retir...
⭐ 0· 70·0 current·0 all-time
bypeandrover adam@peand-rover
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name and description match a legitimate use: creating marketing/educational videos for financial advisors. However, producing videos (TTS, stock footage, video rendering, hosting) normally requires external services, binaries, or credentials; none are declared. This mismatch is noteworthy but could be explained if the skill only generates scripts/templates rather than actual video files.
Instruction Scope
The provided SKILL.md text is heavily descriptive and use-case focused. Because this is an instruction-only skill with no code files, the runtime instructions (not fully shown) are the entire attack surface. The absence of declared env vars or endpoints means either the instructions: (a) generate text/scripts only, (b) expect platform-provided tools (not declared), or (c) omitted needed integration details. If the instructions ask the agent to solicit or embed client-specific financial data (PII/financial accounts), that raises privacy and compliance concerns; that behavior was not visible in the truncated content.
Install Mechanism
No install spec and no code files — lowest install risk. Nothing will be written to disk by an installer because there is no install step declared.
Credentials
Zero required environment variables or credentials are declared. For genuine video creation workflows you'd expect API keys (TTS, video render, asset storage/CDN, stock footage) or at least notes explaining reliance on platform services. The lack of declared credentials could mean the skill is limited to producing scripts only, or it fails to declare access it actually needs — either way this is disproportionate to the advertised capability.
Persistence & Privilege
Skill is not always-enabled and does not request elevated persistence. Autonomous invocation is allowed (platform default) but not combined with other high-risk elements here. No indicators it modifies other skills or system settings.
What to consider before installing
This skill claims to create marketing videos but declares no integrations, credentials, or installers — ask the developer (or inspect the full SKILL.md) how videos are actually produced: which services/APIs or binaries it uses, what credentials (if any) you'll need, and whether the skill will ever request or store client financial data. If it will call third-party APIs, require: 1) a list of endpoints and the exact env vars/keys needed, 2) privacy/compliance assurances for handling PII/financial info, and 3) a sample run or transcript showing what data the agent requests. Do not provide real client account numbers, Social Security numbers, or full financial records until you confirm where data is sent and how it is stored/retained.Like a lobster shell, security has layers — review code before you run it.
latestvk97ec9eeh02r84n58h7krzgdyn84evt3
License
MIT-0
Free to use, modify, and redistribute. No attribution required.