Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

video

v1.0.1

Generate video using SkillBoss API Hub (video generation, auto-routed via /v1/pilot).

0· 122·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for kirkraman/jx-video.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "video" (kirkraman/jx-video) from ClawHub.
Skill page: https://clawhub.ai/kirkraman/jx-video
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: uv
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install jx-video

ClawHub CLI

Package manager switcher

npx clawhub@latest install jx-video
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
Name/description, SKILL.md, and the script all align: the skill uploads a prompt (and optional images) to SkillBoss API Hub and downloads an MP4. However the registry metadata lists no required env vars while both SKILL.md metadata and the script require SKILLBOSS_API_KEY; this metadata mismatch is inconsistent and should be corrected.
Instruction Scope
Runtime instructions are narrowly scoped: run scripts/generate_video.py with uv, the script reads any referenced local images, calls https://api.skillbossai.com/v1/pilot with the prompt/images, downloads the returned video URL, and writes an output MP4. It does not reference unrelated system files, other env vars, or unexpected remote endpoints.
Install Mechanism
There is no install spec (instruction-only) and included code is run via the uv runner. No external archive downloads or installers are specified. Including a code file without an install step is not ideal but not inherently risky.
!
Credentials
The script requires SKILLBOSS_API_KEY (it reads os.environ['SKILLBOSS_API_KEY']) but the registry lists no required env vars or primary credential. Requesting one API key for the remote service is proportionate to the functionality, but the metadata omission is an inconsistency that could lead to runtime errors or confusion. No other credentials are requested.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system settings, and only writes the output video file that the user explicitly names. Autonomous invocation is allowed (default) but not combined with other elevated privileges.
What to consider before installing
This skill's code and instructions match its stated purpose (it sends prompts/images to api.skillbossai.com and downloads an MP4). However: (1) the registry metadata omitted the SKILLBOSS_API_KEY requirement — the script will fail without that env var; confirm the author updates metadata before installing. (2) The SkillBoss API domain (api.skillbossai.com) is a third-party endpoint: any prompt text and images you send will be transmitted to that service, so don't send secrets or sensitive images. (3) There is no homepage or known publisher info — consider this untrusted until you can verify the author. Recommended actions: inspect the included script yourself (already provided), verify and set up a dedicated API key with appropriate scope, run the tool in a sandboxed environment or restricted account, and ask the publisher to correct the registry metadata (declare SKILLBOSS_API_KEY) and provide a homepage or contact. If you need higher assurance, request the publisher provide a signed release or host the project on a known repository for further review.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎬 Clawdis
Binsuv
aivk978nnnrz1pgt8n1sztjpwrecd857aswlatestvk978nnnrz1pgt8n1sztjpwrecd857asw
122downloads
0stars
2versions
Updated 1w ago
v1.0.1
MIT-0

Veo (Video Generation via SkillBoss API Hub)

Generate video clips using SkillBoss API Hub's video generation capability.

Generate video

uv run {baseDir}/scripts/generate_video.py --prompt "your video description" --filename "output.mp4"

Options

  • --duration / -d: Video duration in seconds (default: 8, max varies by model)
  • --aspect-ratio / -a: Aspect ratio (16:9, 9:16, 1:1)
  • --model: Optional model hint (SkillBoss API Hub auto-routes to optimal video model)

API key

  • SKILLBOSS_API_KEY env var

Notes

  • SkillBoss API Hub automatically routes to the best available video model
  • Output is MP4 format
  • Supports image-to-video with --input-image
  • The script prints a MEDIA: line for Clawdbot to auto-attach on supported chat providers.

Comments

Loading comments...