Back to skill
Skillv1.0.0
ClawScan security
Free 4K Video Upscaler – Upscale Video to 4K Online with AI – API-powered · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 17, 2026, 6:35 AM
- Verdict
- Benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's requirements and runtime instructions are consistent with a WeShop API-powered video upscaler and only ask for a single service API key, but the package lacks a known source/homepage and the SKILL.md has minor inconsistencies you should note before installing.
- Guidance
- This skill appears coherent for calling WeShop's openapi.weshop.ai and only asks for the WeShop API key. Before installing: confirm the skill's provenance (there's no homepage or publisher site listed), verify you trust openapi.weshop.ai, and only provide a key you control. Do not paste your API key into other domains. Be cautious uploading sensitive video content to a third-party service; if possible use a short-lived/test key and revoke it if anything looks wrong. Note the SKILL.md mixes image and video terminology — ask the publisher for clarification about how to upload local video files and where outputs are stored.
Review Dimensions
- Purpose & Capability
- okName/description (4K video upscaler) align with required environment access: a single WESHOP_API_KEY for openapi.weshop.ai. Requesting an API key for the service the skill integrates with is proportionate.
- Instruction Scope
- noteSKILL.md provides concrete endpoints, auth guidance, and run/poll instructions limited to openapi.weshop.ai and tells the agent to check WESHOP_API_KEY before asking the user. Minor inconsistencies: it documents an image upload endpoint and example payload fields (originalImage) even though the skill is described as a video upscaler; the docs do not describe how to upload local video files (only image asset upload is called out). These are scope/clarity issues but not explicit overreach.
- Install Mechanism
- okInstruction-only skill with no install spec and no code files — nothing is downloaded or written to disk by the skill itself, which minimizes install risk.
- Credentials
- okOnly a single service credential (WESHOP_API_KEY) is required and it is the declared primary credential. That matches the stated purpose; no unrelated secrets or system config paths are requested.
- Persistence & Privilege
- okalways is false and default agent invocation is allowed (normal). The skill does not request persistent system-level privileges or modifications to other skills.