Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
VPick AI Video Creator
v1.0.2All-in-one AI video production studio on a visual canvas. Generate videos (Kling 3.0, Veo 3.1, Sora 2, Runway, Grok, Midjourney Video), generate images (nano...
⭐ 0· 54·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (AI video studio) align with the runtime instructions (create projects, upload images, run image/video generators, TTS, lip-sync, combine/export). It legitimately aggregates many third-party models via the VPick server (vpick.10xboost.org), which is consistent with the claimed capabilities.
Instruction Scope
The SKILL.md tells the agent to send prompts and uploaded media to the VPick server which then forwards them to multiple external providers. This is expected for a cloud-based video service, but the doc contains an internal inconsistency: it states 'no separate API keys or credentials are needed' (auth via MCP link) while one model row (ElevenLabs STS v2) notes 'Free (user API key)'. It's unclear whether some providers require you to supply separate keys or whether VPick proxies them — that ambiguity affects privacy and setup. The instructions otherwise do not ask the agent to read local files or environment variables beyond uploading user media and using the MCP link.
Install Mechanism
This is an instruction-only skill (no install spec, no code files). That minimizes on-disk installation risk; nothing is downloaded or executed by the skill itself.
Credentials
The skill declares no required env vars or credentials and relies on an MCP URL (embedded token) supplied by the user. That's proportionate for a connector pattern, but the SKILL.md's unclear statement about ElevenLabs STS and the phrase 'treat your MCP link like a password' mean the MCP link is effectively a secret that will be stored in the agent/connector — verify where/how that token is stored and who can access it. No other unrelated credentials are requested.
Persistence & Privilege
always is false and the skill is user-invocable. It does not request permanent presence or claim to modify other skills/configs. Normal autonomous invocation is allowed by default and not a unique concern here.
What to consider before installing
This skill appears to do what it says (cloud-based end-to-end video creation) but it routes your prompts and uploaded media through vpick.10xboost.org and onward to many third-party providers. Before installing: (1) Verify the privacy/retention policy on the VPick site and confirm where your media and prompts are stored and for how long. (2) Treat your MCP link as a secret — understand where the connector stores it and who can access that token. (3) Clarify whether any providers (e.g., ElevenLabs STS) require you to supply separate API keys despite the doc's 'no separate API keys needed' claim. (4) Consider using limited-permission or throwaway account/credits for sensitive content. If the project requires strong confidentiality, avoid uploading sensitive media until you confirm data handling and credentials behavior.Like a lobster shell, security has layers — review code before you run it.
latestvk97dqaq7jkemvskse1pjcpb1pd83pv2a
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis