Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Aliyun Wan R2v

v1.0.0

Use when generating reference-based videos with Alibaba Cloud Model Studio Wan R2V models (wan2.6-r2v-flash, wan2.6-r2v). Use when creating multi-shot videos...

0· 0·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
Name/description, SKILL.md content, and the helper script all align with an Alibaba Cloud Model Studio Wan R2V integration (request preparation, polling guidance, recommended model names). The included prepare_r2v_request.py is small and matches the stated purpose.
!
Instruction Scope
SKILL.md instructs creating a venv, installing the 'dashscope' SDK, and setting DASHSCOPE_API_KEY or adding dashscope_api_key to ~/.alibabacloud/credentials — but the skill metadata lists no required env vars. Validation steps and output paths in SKILL.md reference 'skills/ai/video/aliyun-wan-r2v/scripts/prepare_r2v_request.py' and 'output/aliyun-wan-r2v/', while the repo files live at 'scripts/prepare_r2v_request.py' and the helper script writes to 'output/ai-video-wan-r2v/'. These path mismatches mean the provided validation commands may fail and indicate sloppiness in instructions. Aside from these inconsistencies, the instructions don't request unrelated files or unexpected external endpoints.
Install Mechanism
There is no formal install spec (instruction-only). The SKILL.md recommends pip installing 'dashscope' inside a venv; this is an expected approach for using an SDK but the package origin isn't validated in the skill. Instruction-only skills are lower risk than downloaded/executed archives, but you should confirm 'dashscope' is the official Alibaba SDK before installing.
!
Credentials
SKILL.md requires DASHSCOPE_API_KEY or credentials in ~/.alibabacloud/credentials but the skill manifest declares no required environment variables or primary credential. Asking for an API key for the provider is reasonable for the described functionality, but the omission from metadata is an inconsistency that could confuse users and automated permission checks.
Persistence & Privilege
The skill is not always-enabled and does not request system-wide changes. It does write request/response artifacts to an output directory (as described), which is reasonable for a provider integration.
What to consider before installing
This skill appears to implement what it claims (a helper for Alibaba Wan R2V), but the instructions and manifest don't match in a few places. Before installing or running it: 1) Do not blindly export credentials — create a least-privilege DASHSCOPE_API_KEY for testing. 2) Verify the 'dashscope' package is the official SDK (check PyPI and vendor docs). 3) Fix/check paths in SKILL.md: the validation command references a different path than the actual script, and the script's default output dir differs from the SKILL.md output locations; run the helper script manually with explicit paths to ensure it behaves as expected. 4) Run in an isolated environment (venv or container) and inspect the helper script (it is small and only builds/validates JSON). If those mismatches are corrected, the skill is coherent; until then treat the package as suspicious due to documentation/manifest inconsistencies.

Like a lobster shell, security has layers — review code before you run it.

latestvk971p8aybgrqf0z9ajfd6pr4d58403zz

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Category: provider

Model Studio Wan R2V

Validation

mkdir -p output/aliyun-wan-r2v
python -m py_compile skills/ai/video/aliyun-wan-r2v/scripts/prepare_r2v_request.py && echo "py_compile_ok" > output/aliyun-wan-r2v/validate.txt

Pass criteria: command exits 0 and output/aliyun-wan-r2v/validate.txt is generated.

Output And Evidence

  • Save reference input metadata, request payloads, and task outputs in output/aliyun-wan-r2v/.
  • Keep at least one polling result snapshot.

Use Wan R2V for reference-to-video generation. This is different from i2v (single image to video).

Critical model names

Use one of these exact model strings:

  • wan2.6-r2v-flash
  • wan2.6-r2v

Newer official releases may prefer the flash variant for lower latency and lower cost.

Prerequisites

  • Install SDK in a virtual environment:
python3 -m venv .venv
. .venv/bin/activate
python -m pip install dashscope
  • Set DASHSCOPE_API_KEY in your environment, or add dashscope_api_key to ~/.alibabacloud/credentials.

Normalized interface (video.generate_reference)

Request

  • prompt (string, required)
  • reference_video (string | bytes, required)
  • reference_image (string | bytes, optional)
  • duration (number, optional)
  • fps (number, optional)
  • size (string, optional)
  • seed (int, optional)

Response

  • video_url (string)
  • task_id (string, when async)
  • request_id (string)

Async handling

  • Prefer async submission for production traffic.
  • Poll task result with 15-20s intervals.
  • Stop polling when SUCCEEDED or terminal failure status is returned.

Local helper script

Prepare a normalized request JSON and validate response schema:

.venv/bin/python skills/ai/video/aliyun-wan-r2v/scripts/prepare_r2v_request.py \
  --prompt "Generate a short montage with consistent character style" \
  --reference-video "https://example.com/reference.mp4"

Output location

  • Default output: output/aliyun-wan-r2v/videos/
  • Override base dir with OUTPUT_DIR.

Workflow

  1. Confirm user intent, region, identifiers, and whether the operation is read-only or mutating.
  2. Run one minimal read-only query first to verify connectivity and permissions.
  3. Execute the target operation with explicit parameters and bounded scope.
  4. Verify results and save output/evidence files.

References

  • references/sources.md

Files

4 total
Select a file
Select a file to preview.

Comments

Loading comments…