Skillv1.0.0

ClawScan security

Improve Video Quality Online Free – Enhance Video Quality with AI – API-powered · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

SuspiciousApr 20, 2026, 10:23 AM

Verdict: suspicious
Confidence: medium
Model: gpt-5-mini
Summary: The skill largely matches a WeShop video-enhancement integration and only requests a single WeShop API key, but the runtime instructions contain inconsistent/ambiguous fields (references to image endpoints and an originalImage field) and the package has no listed homepage or source — this mismatch and lack of provenance merit caution.
Guidance: This skill appears to call WeShop's API and only asks for the expected WESHOP_API_KEY, which is proportionate — but there are several reasons to be cautious before installing or supplying your API key: - The SKILL.md mixes 'video' and 'image' terminology (references to an images upload endpoint and originalImage field) and does not clearly document how video files are uploaded or whether local videos would be sent to external servers. Ask the skill author to clarify how video assets are provided and where they are uploaded. - There is no homepage or source repository listed and the owner is unknown; lack of provenance increases risk. Prefer skills with clear authorship and documentation. - The doc explicitly warns not to send the API key anywhere except openapi.weshop.ai — follow that. If you install, verify (or request) that the agent actually sends requests only to openapi.weshop.ai and not to other domains. - If you must test, use a limited-scope or throwaway API key first and observe network calls. Check the provider's privacy/TOS to understand how uploaded videos are stored or processed. If you cannot obtain clarifications about the image/video inconsistencies or the skill's origin, treat this as untrusted and do not provide a production API key.

Review Dimensions

Purpose & Capability: noteThe declared purpose (upscale/enhance video via WeShop) aligns with the single required env var (WESHOP_API_KEY) and the documented endpoints pointing to openapi.weshop.ai. However the SKILL.md mixes video and image terminology (e.g., POST /openapi/agent/assets/images, an input example using originalImage, and no clear video asset upload endpoint). The lack of a homepage/source for the skill owner also reduces provenance.
Instruction Scope: noteInstructions are narrow and only tell the agent to call openapi.weshop.ai endpoints and to check the WESHOP_API_KEY env var before prompting the user; they explicitly warn not to send the API key elsewhere. The ambiguity around uploading 'local image' assets versus expected video uploads is scope creep/unclear and could lead to unexpected file uploads if implemented by an agent.
Install Mechanism: okInstruction-only skill with no install spec and no code files — nothing is written to disk or downloaded during install, which minimizes install-time risk.
Credentials: okOnly a single credential (WESHOP_API_KEY) is required and declared as primary — this is proportionate for a third-party API integration. The SKILL.md's explicit guidance to only send the key to openapi.weshop.ai is a positive control.
Persistence & Privilege: okThe skill does not request always:true and is not force-included. It can be invoked by the agent (default), which is normal for skills; there is no request to modify other skills or system-wide settings.