Skillv1.0.0

ClawScan security

Free Online Video Quality Enhancer – Improve Video Quality with AI – API-powered · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

SuspiciousApr 17, 2026, 6:36 AM

Verdict: suspicious
Confidence: medium
Model: gpt-5-mini
Summary: The skill mostly matches a video-enhancement API but the runtime instructions contain inconsistencies (image endpoints/example vs. video inputs) and ask the agent to upload local media, so you should verify details before trusting it with real API keys or sensitive files.
Guidance: Before installing: 1) Verify the provider (openapi.weshop.ai / weshop.ai) and read their privacy/terms so you know how uploaded media and outputs are used. 2) Confirm whether the API and agent actually accept video uploads/URLs (the SKILL.md mixes 'image' endpoints and an 'originalImage' example with 'videos' fields) — ask the skill author or test with a non-sensitive sample. 3) Only provide your WESHOP_API_KEY if you trust the endpoint; never paste it into other domains. 4) Expect the agent may request to upload local media — do not allow uploads of sensitive or private files. 5) If you proceed, use a limited/rotatable API key and monitor usage; request clearer docs from the publisher to resolve the image/video inconsistencies.

Review Dimensions

Purpose & Capability: noteThe declared purpose (AI video quality enhancement) aligns with the single required credential (WESHOP_API_KEY) and the listed agent endpoints on openapi.weshop.ai. However, the SKILL.md repeatedly references image upload endpoints (POST /openapi/agent/assets/images) and an example payload with originalImage, which conflicts with the stated video-focused inputs (input.videos, videos param). This mismatch could be a documentation error or indicate the skill is actually image-focused; it is not strictly proportional but not obviously malicious.
Instruction Scope: noteThe instructions are scoped to the WeShop API host and explicitly warn not to send the API key elsewhere — that is good. They also instruct uploading local media (images) to the API, which implies the agent may read local files for upload; the document does not explicitly restrict which local files to read. The mismatch between image-related endpoints/examples and the declared video inputs increases the chance the agent will ask to access or upload the wrong type of local file or prompt confusing user behavior.
Install Mechanism: okThis is an instruction-only skill with no install spec or code files, so nothing is written to disk and no external packages are pulled in — lowest install risk.
Credentials: okOnly a single environment variable (WESHOP_API_KEY) is requested and declared as the primary credential. That is proportionate for an integration with a third-party API.
Persistence & Privilege: okThe skill does not request always:true, has no install script, and does not modify system or other skills' configuration. It does allow normal autonomous invocation (platform default).