ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

MiVisionForgeSVOR

v1.0.5

Video Object Remove with SVOR(stable video object removal).

⭐ 2· 120·0 current·0 all-time
byFei Wang@wangfei1204
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (video object removal) match the actual behavior: the script compresses and uploads videos to a remote SVOR endpoint and processes returned masks. Required binaries (python3, ffmpeg) and a single API key are appropriate for the described task.
ℹ
Instruction Scope
SKILL.md and the script explicitly instruct uploading the full video to https://mipixgen-pre.ai.mioffice.cn and downloading processed results; this is necessary for a cloud-based removal service but is privacy-sensitive (the README also warns about not uploading sensitive content). No instructions attempt to read unrelated local secrets or system config.
✓
Install Mechanism
No install spec (instruction-only plus an included script). Nothing is downloaded from arbitrary URLs or installed automatically; risk from installation mechanism is low.
✓
Credentials
Only SVOR_API_KEY is required and is used as a Bearer token to authenticate to the documented service endpoint. No unrelated credentials or extra environment variables are requested.
✓
Persistence & Privilege
The skill does not request persistent or system-wide presence (always is false). It writes temporary files in a temp directory under the video's folder, which is expected for media processing.
Assessment
This skill appears coherent but it uploads full videos to a remote service. Before installing, ensure you: (1) trust the endpoint (https://mipixgen-pre.ai.mioffice.cn) and the operator (declared as Xiaomi team), (2) do not upload videos containing sensitive or personally identifiable information, (3) keep your SVOR_API_KEY secret and avoid setting it in shared environments, (4) have ffmpeg and Python 3 installed and test the tool first with a small non-sensitive video, and (5) review any service terms or data-retention policy from the operator if you need stronger privacy guarantees.

Like a lobster shell, security has layers — review code before you run it.

latestvk976zhdngmvt4p49zfa261rsjd84yn4m

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Binspython3, ffmpeg
EnvSVOR_API_KEY
Primary envSVOR_API_KEY

Comments