Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

铁锈老物件翻新修复视频

v1.0.2

Generate vertical satisfying rust restoration shorts (WeryAI): text-to-video or rusty-object image to grind and polish motion. Use when you need rust restora...

0· 104·0 current·0 all-time
byparallel world@zoucdr

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for zoucdr/rust-restore-video.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "铁锈老物件翻新修复视频" (zoucdr/rust-restore-video) from ClawHub.
Skill page: https://clawhub.ai/zoucdr/rust-restore-video
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: WERYAI_API_KEY
Required binaries: node
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install rust-restore-video

ClawHub CLI

Package manager switcher

npx clawhub@latest install rust-restore-video
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (rust restoration video generation) match what is required: Node.js and a WERYAI_API_KEY. The bundled CLI script and API docs target WeryAI endpoints and model registry, which is appropriate for the described capability.
Instruction Scope
SKILL.md gives detailed, confined runtime instructions (prompt expansion, confirmation before submit, model constraints). It explicitly calls out the risk of local-image handling and instructs obtaining explicit consent before reading/uploading local files. This is appropriate, but be aware the bundled script will read local file paths and upload them if invoked with a local path, so the agent must enforce the consent step in practice.
Install Mechanism
No install spec is provided (instruction-only packaging with a bundled script). That is low-risk: nothing is fetched or executed during install. The script is bundled with the skill (no external downloads), so no unexpected network install behavior is present.
Credentials
Only WERYAI_API_KEY is required (declared as primaryEnv) plus Node.js. That key is necessary for model listing, generation, and (optionally) upload endpoints; the request is proportionate to the skill's function. No other credentials or unrelated env vars are requested.
Persistence & Privilege
The skill is not forced-always (always: false) and does not request system-wide persistence or other skills' configs. It can be invoked autonomously (platform default), which is expected for an agent skill. No elevated privileges are requested.
Assessment
This skill appears coherent with its stated purpose, but follow these precautions before enabling it: (1) Review the bundled scripts/video_gen.js yourself (or ask for a review) because it can read local image files and will upload them to WeryAI if given a local path. Only allow local-file usage after explicit user consent. (2) Only provide your WERYAI_API_KEY if you trust the skill and the destination service; treat the key as a secret. (3) Prefer supplying public https image URLs to avoid uploading local files. (4) Be aware each real run consumes WeryAI credits—test with dry-run where available and consider running in an isolated environment or separate account for higher assurance.
scripts/video_gen.js:675
Environment variable access combined with network send.
!
scripts/video_gen.js:223
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🛠️ Clawdis
Binsnode
EnvWERYAI_API_KEY
Primary envWERYAI_API_KEY
latestvk97423q7yzt4femx6rvrymc8g183f0ze
104downloads
0stars
3versions
Updated 1mo ago
v1.0.2
MIT-0

Rusty object restoration video generation

Rusty knives, blackened padlocks, vintage lighters—the moment the wheel touches, scale tears away and bare metal lights up along the grind path. “Junk reborn” is a high-completion lane for satisfying / men’s content; one line or one rust photo, straight to clip.

Dependencies: WERYAI_API_KEY + Node.js 18+. When you run the CLI, scripts/video_gen.js must exist; WERYAI_VIDEO_API.md must exist under resources/ (supply both via publish or pre-use assembly). Full commands and JSON fields: see resources/WERYAI_VIDEO_API.md. No other Cursor skills. Default parameters and model tiers are in the tables below; live API limits follow weryai models. Before installing or running, review the bundled video_gen.js to confirm it meets your requirements. Pay particular attention to how it handles local files if you choose to allow their usage, ensuring this behavior aligns with the skill's intended workflow for image-to-video requests.

Prerequisites

  • WERYAI_API_KEY must be set in the environment before running video_gen.js.
  • Node.js 18+ is required. Prefer public https image URLs. If the assembled scripts/video_gen.js supports local file paths, review and verify the script first, then get explicit consent before it reads a local image and uploads it to WeryAI to obtain a public URL.
  • Each successful wait run consumes WeryAI credits; re-running creates new paid tasks.

Security, secrets, and API hosts

  • WERYAI_API_KEY: Treat as a secret. Only configure it if you trust this skill's source; it is listed in OpenClaw metadata as requires.env / primaryEnv so installers know it is mandatory at runtime (never commit it inside the skill package).
  • API hosts (fixed in video_gen.js): Video tasks use https://api.weryai.com; the models list uses https://api-growth-agent.weryai.com. Only WERYAI_API_KEY is read from the environment—do not rely on URL-related environment variables.
  • Local image handling disclosure: Prefer public https image URLs. If the assembled scripts/video_gen.js supports local file paths, it may read a local image and upload it to WeryAI to obtain a public URL; require review / verification and explicit consent before using that path.
  • Higher assurance: Run generation in a short-lived or isolated environment (separate account or container), and review scripts/video_gen.js (HTTPS submit + poll loop) before production use. Verify whether the runtime can read local image files and upload them to WeryAI, and obtain explicit consent before using that path.

Prompt expansion (mandatory)

video_gen.js does not expand prompts. Before every wait --json, turn the user's short or vague brief into a full English production prompt.

When: The user gives only keywords, one line, or loose intent—or asks for richer video language. Exception: They paste a finished long prompt within the model's prompt_length_limit and ask you not to rewrite; still show the full text in the confirmation table.

Always add (video language): shot scale and angle; camera move or lock-off; light quality and motivation; subject action paced to duration; one clear payoff for this niche; state 9:16 vertical when this skill defaults to vertical.

Length: Obey prompt_length_limit for the chosen model_key when this doc lists it; trim filler adjectives before removing core action, lens, or light clauses.

Confirmation: The pre-submit table must include the full expanded prompt (never a one-line summary). Wait for confirm or edits.

Niche checklist

  • Restore arc: rust/oxidized → abrasive/polish/coat steps → shine reveal; macro metal texture.
  • Motion: rotary tool, wipe, cloth buff—readable cause→effect; sparks optional if stylized safe.
  • Reflection: final specular read proves the restore.

### Example prompts at the top of this file are short triggers only—always expand from the user's actual request.

Workflow

  1. Confirm the user request matches this skill's scenario (text-to-video and/or image-to-video as documented).
  2. Collect the user's brief, optional image URL(s), tier (best / good / fast) or an explicit model key.
  3. Expand prompt (mandatory): Unless the user supplied a finished long prompt and explicitly asked not to rewrite it, expand the brief into a full English production prompt using ## Prompt expansion (mandatory) below. Do not call the API with only the user's minimal words.
  4. Check the expanded prompt against the selected model's prompt_length_limit in the frozen tables in this document (when present); shorten if needed.
  5. Verify duration, aspect_ratio, resolution, generate_audio, negative_prompt, and other fields against the frozen tables in this document and WERYAI_VIDEO_API.md.
  6. Show the pre-submit parameter table including the full expanded prompt; wait for confirm or edits.
  7. After confirmation, run node scripts/video_gen.js wait --json '...' with the expanded prompt.
  8. Parse stdout JSON and return video URLs; on failure, surface errorCode / errorMessage and suggest parameter fixes.

CLI reference

node scripts/video_gen.js wait --json '{"model":"…","prompt":"…","duration":5,"aspect_ratio":"9:16"}'
node scripts/video_gen.js wait --json '…' --dry-run
node scripts/video_gen.js status --task-id <id>

Full reference: WERYAI_VIDEO_API.md.

Definition of done

Done when the user receives at least one playable video URL from the API response, or a clear failure explanation with next steps. All parameters used must fall within the selected model's allowed sets in this document. The submitted prompt must be the expanded production prompt unless the user explicitly supplied a finished long prompt and asked not to rewrite it.

Boundaries (out of scope)

  • We do not review platform compliance, copyright, or likeness; we do not warrant commercial usability of outputs.
  • We do not provide offline rendering outside WeryAI, traditional NLE projects, or API field combinations not documented in this SKILL or WERYAI_VIDEO_API.md.
  • Do not link to weryai-model-capabilities.md or shared ../references/ paths; use resources/WERYAI_VIDEO_API.md for CLI/API details.
  • Do not hard-code absolute paths in this doc; run from the skill package root (next to SKILL.md) so scripts/ and resources/ paths resolve.

Example prompts

  • Rusty wrench sanded and polished to mirror metal, vertical satisfying restore
  • From this rusty pan: scale curls off, bottom brightens
  • Old-tool restore vibe—each step readable, not too fast
  • Rusty tool restoration 9:16, corrosion flakes off then mirror shine

Default parameters

FieldValue
ModelKLING_V3_0_PRO
Aspect9:16 (fixed, vertical short)
DurationShort (duration: 5)
LookTight macro, dark workshop (wood bench / anvil), side light on metal texture, slow-mo sparks and rust dust (fixed)
AudioOn (wheel + metal friction ASMR is core)

API validity (default KLING_V3_0_PRO): Text-to-video: duration only 5 / 10 / 15, aspect_ratio only 9:16, 1:1, 16:9; image-to-video: aspect_ratio only 9:16, 16:9, 1:1; no resolution field—do not send. Fast VEO tier: text VEO_3_1_FAST, image CHATBOT_VEO_3_1_FAST, duration fixed 8, aspect_ratio only 9:16 or 16:9. For other model_key values, follow the allowed sets in this document and the API validity notes above; do not send unsupported fields such as resolution.


Text-to-video: restore from description

Give object type (old knife / padlock / lighter / wrench / gear) and the beat to show (grind / polish / oil / reassembly); the skill fills visual detail.

Flow:

Collect object + action, pick the strongest phase (scale peel / shine appears / mirror finish) → build prompt → show parameters and wait for confirmation → run node scripts/video_gen.js wait --json '…'.

Full parameters are shown before generate; wait for confirmation.

Parameters:

FieldValue
modelKLING_V3_0_PRO
aspect_ratio9:16
duration5
generate_audiotrue

Expanded prompt: Compose at generation time per ## Prompt expansion (mandatory) from the user's actual brief—do not reuse fixed sample paragraphs.

Expected outcome: Rust vs. shine boundary is the main hook; grind path + wheel ASMR; mirror reflection as emotional peak.


Rusty image → restoration motion

Provide a photo of a rusty object; generate motion from rusted surface to bright metal. Good for turning spare junk photos into content.

Prefer a public https image URL. If the assembled scripts/video_gen.js supports local file paths, review/verify the script and explicitly consent before local read-and-upload to WeryAI.

After the URL, optionally name the phase (grind / polish / oil); if omitted, pick the phase with strongest rust→clean contrast from the image.

Flow:

Confirm URL, infer object and rust level, choose angle for max contrast → show parameters and wait → run node scripts/video_gen.js wait --json '…' (JSON includes image).

Full parameters are shown before generate; wait for confirmation.

Parameters:

FieldValue
modelKLING_V3_0_PRO
aspect_ratio9:16
duration5
generate_audiotrue
imageUser image URL

Sample prompt:

Starting from the rusty metal object in the image, a grinding wheel or abrasive pad moves methodically across the corroded surface, the rust layer is stripped away in one continuous slow-motion pass at 240fps revealing the bright original metal beneath, the clean-rust boundary line advances steadily through frame. Camera angle and framing match the image composition, single directional side light rakes across the surface to maximize texture contrast between corroded and polished areas. Rust powder and fine metallic sparks scatter in the air. ASMR grinding and metal friction sound.

Expected outcome: Grind direction matches rust coverage in the upload; strong return of true metal color.


Prompt tips

Rust texture

  • Rust surface: heavy orange-brown corrosion pitting, flaking rust scale, uneven oxidation crust, rust powder suspended in air
  • Grind advance: clean-rust boundary advances, bright metal exposed millimeter by millimeter, grinding path reveals polished steel
  • Polish finish: mirror finish emerges, reflection sharpens as polishing progresses, surface transforms from matte to specular

Common notes

  • Smaller objects (lighter / knife): tighter macro—add extreme close-up macro
  • Full arc (derust → polish → assembly): use duration 10 and say so at confirmation
  • Prefer public https URLs; private hosts or in-app-only links may fail. If the runtime supports local paths, review scripts/video_gen.js and explicitly consent before local read-and-upload to WeryAI.

Note: KLING_V3_0_PRO supports negative_prompt to exclude unwanted hands, tool occlusion, etc.—mention at confirmation if you want it added.

Comments

Loading comments...