Back to skill
Skillv1.0.0
ClawScan security
Grok Imagine AI Video Generator – Create Cinematic AI Videos with Native Audio & Scene Control – API-powered · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 17, 2026, 4:08 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requests and runtime instructions are consistent with a video-generation integration for openapi.weshop.ai and do not ask for unrelated access or installs.
- Guidance
- This skill appears internally consistent, but take these practical precautions before enabling it: 1) Verify the API provider (weshop.ai) and the API key issuance page before providing a key — the registry metadata lists 'source: unknown' though SKILL.md references https://www.weshop.ai. 2) Prefer setting WESHOP_API_KEY as an environment variable (the skill checks for it) rather than pasting it into chat. 3) Limit and rotate the API key in the provider's dashboard, and monitor usage/billing for unexpected activity. 4) If possible, restrict network egress to only the domain openapi.weshop.ai or use allowlisting, since the skill will perform network calls and upload images/text to that service. 5) Understand that any images or text you send will be transmitted to the remote API for processing; do not send sensitive data unless you trust the provider.
Review Dimensions
- Purpose & Capability
- okName/description (Grok Imagine video generator) align with the declared dependency: a single WESHOP_API_KEY used to call openapi.weshop.ai endpoints for starting runs, polling status, and uploading images.
- Instruction Scope
- okSKILL.md is narrowly scoped: it documents the specific endpoints, expected request/polling flow, and explicitly warns not to send the API key to other domains. It does not instruct reading local files, other env vars, or contacting unrelated endpoints.
- Install Mechanism
- okInstruction-only skill with no install spec or code files; nothing will be written to disk by the skill itself.
- Credentials
- okOnly a single API key (WESHOP_API_KEY) is required which is appropriate for a single-provider API integration; the SKILL.md also warns about restricting key use to openapi.weshop.ai.
- Persistence & Privilege
- okalways is false and the skill does not request elevated or persistent system privileges or modify other skills' configs. Autonomous invocation is allowed (platform default) but not excessive here.