Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Media.io Wan Video Generator

v1.0.0

Generate 1080p AI videos via Media.io Wan (v2.6) using text, images, or reference videos through the Media.io OpenAPI.

0· 152·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for wondershare-boop/mediaio-wan-video-generator.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Media.io Wan Video Generator" (wondershare-boop/mediaio-wan-video-generator) from ClawHub.
Skill page: https://clawhub.ai/wondershare-boop/mediaio-wan-video-generator
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install mediaio-wan-video-generator

ClawHub CLI

Package manager switcher

npx clawhub@latest install mediaio-wan-video-generator
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name, description, SKILL.md, _meta.json, and included c_api_doc_detail.json all describe a Media.io Wan video generator and the code implements calls to media.io endpoints — this is coherent. However the registry summary at the top of the submission claims 'Required env vars: none' while the skill files (SKILL.md and _meta.json) require an API_KEY. That metadata mismatch is a coherence problem (likely an oversight) and should be corrected.
Instruction Scope
SKILL.md instructs only how to call Media.io APIs and the runtime code (scripts/skill_router.py) only reads API_KEY from env or argument and performs HTTPS requests to the documented endpoints. There are no instructions to read unrelated files, system state, or to transmit data to third parties beyond the Media.io API host.
Install Mechanism
There is no install spec (instruction-only), which lowers disk-write risk. However the bundled code imports the Python 'requests' library but no dependency manifest declares it. That is an inconsistency: the runtime environment must provide 'requests' or the code will fail. No external download URLs or archives are used.
Credentials
The only runtime secret accessed is API_KEY (used as X-API-KEY) which is appropriate for the described Media.io integration. Again, the registry-level metadata omitted this required env var while SKILL.md and _meta.json include it — this mismatch should be fixed. No other credentials or secrets are requested.
Persistence & Privilege
The skill does not request persistent/system privileges, does not set always:true, and does not modify other skills' configurations. It runs network requests only to a single allowed host as enforced by the code.
What to consider before installing
This skill appears to implement what it claims (a Media.io Wan video generator) and the code restricts calls to openapi.media.io, but there are a few things to verify before installing: 1) The registry metadata omitted the required API_KEY—make sure you will only provide a Media.io API key and understand its permissions and billing implications. 2) The Python code uses the 'requests' package but no dependency is declared; run it in an environment that has requests installed or add a dependency declaration. 3) Inspect c_api_doc_detail.json to confirm the endpoints are the official openapi.media.io URLs you expect (the router enforces host == 'openapi.media.io'). 4) Prefer running in an isolated environment (sandbox/VM) first and avoid sharing any high-privilege or long-lived API keys. If you want this skill installed, ask the publisher to fix the registry metadata to list API_KEY as required and to declare the 'requests' dependency so the package metadata and runtime behavior match.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fb6z7td456w2fbwqakbsr49838kwd
152downloads
0stars
1versions
Updated 22h ago
v1.0.0
MIT-0
---
name: mediaio-wan-video-generator
description: "Generate AI videos using Wan (v2.6) via Media.io OpenAPI. Supports text-to-video, image-to-video, and reference-to-video with 1080p output."
metadata: {"mediaio": {"emoji": "", "requires": {"env": ["API_KEY"]}, "priority": "P1", "core_goal_keywords": ["text-to-video", "image-to-video", "reference-to-video"], "trigger_keywords": ["Wan", "Wan video", "Wan AI video generator"]}, "publisher": "Community Maintainer", "source": "https://platform.media.io/docs/"}
---

# Wan AI Video Generator

## Overview
This skill focuses on a single model family and calls Media.io OpenAPI via `Skill.invoke(api_name, params, api_key)`.
It includes only common APIs (`Credits`, `Task Result`) plus model-specific APIs for this skill.

## Core Trigger Keywords
Wan, Wan video, Wan AI video generator

## Core Goal Keywords
text-to-video, image-to-video, reference-to-video

## Environment Variable
- `API_KEY` (required): Media.io OpenAPI key used as `X-API-KEY`.

## Quick Start
```python
import os
from scripts.skill_router import Skill

skill = Skill('scripts/c_api_doc_detail.json')
api_key = os.getenv('API_KEY', '')
result = skill.invoke('Credits', {}, api_key=api_key)
print(result)
```

## Available APIs
- `Credits` (`user-credits`)
- `Task Result` (`generation-result`)
- `Wan 2.2` (`i2v-wan-v2-2`)
- `Wan 2.5` (`i2v-wan-v2-5`)
- `Wan 2.6` (`i2v-wan-v2-6`)
- `Wan 2.5 (Text To Video)` (`t2v-wan-v2-5`)
- `Wan 2.6 (Text To Video)` (`t2v-wan-v2-6`)

## Notes
- Use exact `api_name` from `scripts/c_api_doc_detail.json` when invoking.
- Generation APIs return `task_id`; poll with `Task Result`.

Comments

Loading comments...