AI Video Gen
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill mostly matches video generation, but it has unsafe/under-declared credential handling that users should review before use.
Review and patch the BASE_URL environment-variable bug before using this skill. Treat Doubao API keys and any Feishu app credentials as sensitive, confirm exactly where prompts/images/videos will be uploaded, and only provide local media files you intend to send to the video provider.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The Doubao API key may be mishandled, the tool may fail unexpectedly, or data may be sent to the wrong endpoint in some configurations.
The code uses the API key environment variable as the API base URL instead of VIDEO_GEN_BASE_URL. That can put a secret into the request URL/error path and, if the value is URL-like, send prompts/media plus the Authorization header to an unintended endpoint.
API_KEY = os.environ.get("VIDEO_GEN_API_KEY", "")
BASE_URL = os.environ.get("VIDEO_GEN_API_KEY", "https://ark.cn-beijing.volces.com/api/v3")Fix the code to read VIDEO_GEN_BASE_URL for the endpoint, validate allowed base URLs, avoid logging secret-containing URLs, and declare the required API credential in metadata.
Using this workflow could grant the agent access to Feishu tenant-level upload or messaging capabilities that were not obvious from the registry metadata.
The workflow introduces Feishu tenant app credentials and a file-upload/send path, while the registry metadata declares no primary credential or required environment variables. The artifacts do not bound the Feishu app permissions or require explicit user approval before upload/send.
# 获取 token（使用飞书 app_id 和 app_secret）
resp = requests.post(
"https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal",
json={"app_id": "YOUR_APP_ID", "app_secret": "YOUR_APP_SECRET"}
)Declare the Feishu credential requirement if needed, make Feishu upload optional, document required scopes, and require user confirmation before sending files/messages.
If the agent is given the wrong path, it could upload unintended local file contents as a frame or overwrite a local file with the video output.
The script can read a local file supplied as an image frame and write the downloaded video to a caller-specified path. This is purpose-aligned for image-to-video generation, but it depends on safe, user-approved paths.
with open(first_frame, "rb") as f:
payload["first_frame"] = base64.b64encode(f.read()).decode()
...
with open(output_path, "wb") as f:
f.write(response.content)Only pass user-approved image/media files, validate file types, and save outputs to a safe working directory unless the user explicitly chooses another path.