Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

cogvideox 生成视频

v1.0.2

使用 CogVideoX (智谱AI) 模型根据文本提示词生成视频。

0· 131·0 current·0 all-time
byKing@ilaus

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ilaus/cogvideox-generator.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "cogvideox 生成视频" (ilaus/cogvideox-generator) from ClawHub.
Skill page: https://clawhub.ai/ilaus/cogvideox-generator
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install cogvideox-generator

ClawHub CLI

Package manager switcher

npx clawhub@latest install cogvideox-generator
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description, SKILL.md, and script all align: this is a CogVideoX (ZhipuAI) video-generation skill and it needs a ZHIPUAI_API_KEY. However registry metadata earlier reported "Required env vars: none" and the skill has no homepage/source URL, which is inconsistent and reduces transparency.
Instruction Scope
SKILL.md and the script only describe submitting a video-generation task and polling results from ZhipuAI. There are no instructions to read arbitrary local files, other env vars, or exfiltrate data to unexpected endpoints in the provided files.
!
Install Mechanism
There is no install spec even though the script imports 'zai' and uses ZhipuAiClient; the required Python dependency is not declared and the skill's source/homepage is missing. This is a usability/traceability gap and increases risk because fetched dependencies or missing libs could cause the integrator to install packages manually or run unclear code.
Credentials
The script only needs a single API key (ZHIPUAI_API_KEY), which is appropriate for calling the external service. But the registry metadata claiming no required env vars contradicts the code and SKILL.md, which is an inconsistency the user should note.
Persistence & Privilege
The skill does not request always:true, does not persist configuration or modify other skills, and does not require elevated or system-wide privileges.
What to consider before installing
This skill appears to do what it says (generate video via ZhipuAI) and the script only uses one API key (ZHIPUAI_API_KEY). However: 1) the registry metadata incorrectly lists no required env vars while the code expects ZHIPUAI_API_KEY — confirm the platform will grant the skill that env var only if you trust it; 2) there is no install/dependency specification for the 'zai' SDK and no homepage or source repository for the skill or SDK — verify the provenance of the 'zai' package before installing; 3) since the source is unknown, consider running the skill in an isolated environment or reviewing the 'zai' library/package code and network endpoints it contacts; 4) only provide your ZhipuAI API key if you trust the skill owner; otherwise ask the publisher for a repo, release URL, and a dependency list (or a vetted install spec) before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk9745rjfgp512dhfkjar5jq0vh83v9jb
131downloads
0stars
3versions
Updated 4w ago
v1.0.2
MIT-0

这是一个视频生成技能,调用智谱 AI 的 CogVideoX 接口。

参数说明

  • prompt (string, 必填): 描述视频内容的提示词,越详细效果越好。
  • quality (string, 可选): 输出模式,'quality' (质量优先) 或 'speed' (速度优先)。默认为 'quality'。
  • size (string, 可选): 视频分辨率,如 '1920x1080'。默认为 '1920x1080'。
  • fps (integer, 可选): 帧率,30 或 60。默认为 30。
  • with_audio (boolean, 可选): 是否生成音频。默认为 True。

使用示例

用户说:“帮我生成一个比得兔开小汽车的视频。” AI 将调用此技能,参数为:{"prompt": "比得兔开小汽车,游走在马路上,表情开心"}

Comments

Loading comments...