Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

WeryAI Media Editor

Enhance images, remove backgrounds, create videos from images, and perform AI face swaps using WeryAI advanced media editing tools.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 36 · 0 current installs · 0 all-time installs
byE.S@sunjian
MIT-0
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
Name/description match the code's behavior (image upscale, bg removal, I2V, face-swap via api.weryai.com). However the registry metadata declares no required env or config paths while the code clearly requires an API key (WERYAI_API_KEY) or reads ~/.openclaw/openclaw.json for config. That mismatch between claimed requirements and actual needs is incoherent.
!
Instruction Scope
SKILL.md usage instructs running node with an absolute developer-specific path (/Users/king/...), which is unlikely to be correct for other users. SKILL.md also requires translating I2V prompts to English, but the shipped script contains no translation step. The instructions therefore contain assumptions and expectations not implemented by the code.
Install Mechanism
No install spec is provided (instruction-only skill with a bundled script). That means nothing arbitrary is downloaded during install. The code is local and runs via node; no third-party install steps were hidden.
!
Credentials
The registry metadata lists no required environment variables or config paths, yet the script aborts unless WERYAI_API_KEY is set or ~/.openclaw/openclaw.json contains a weryai.apiKey entry. The missing declaration is a material omission. The skill requests access to a single external API key (proportionate to its function), but the platform manifest should declare it.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and does not write persistent system-wide settings. It only reads a user config file and environment variables.
What to consider before installing
This skill appears to call WeryAI endpoints for the stated media tasks, but before installing you should: 1) confirm you trust the skill author and WeryAI (the script will use your WERYAI_API_KEY or read ~/.openclaw/openclaw.json); 2) be aware the registry metadata omitted that required API key/config path — treat that as a red flag and verify the key usage and permissions; 3) inspect the bundled weryai-media-editor.js yourself (network endpoints are api.weryai.com only) and ensure you are comfortable with face-swap functionality (privacy/legal implications); 4) note the SKILL.md uses an absolute developer path — ensure your agent runs the actual installed script path. If you are unsure, request a version from a verified source or ask the author to correct the manifest to declare the required env/config before installing.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.1.2
Download zip
latestvk97fj1354n1hp26ntkrk12w8k1831jgn

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

WeryAI Media Editor Toolkit

<description> Provides advanced AI media manipulation: Upscaling, Background Removal, Image-to-Video (I2V), and Face Swapping. </description> <usage> ```bash # 1. Upscale / Enhance Quality node /Users/king/weryai-media-editor-skill/weryai-media-editor.js upscale <image_url>

2. Remove Background

node /Users/king/weryai-media-editor-skill/weryai-media-editor.js remove-bg <image_url>

3. Image to Video (I2V)

node /Users/king/weryai-media-editor-skill/weryai-media-editor.js i2v <image_url> "<optional_english_prompt>"

4. Face Swap

node /Users/king/weryai-media-editor-skill/weryai-media-editor.js face-swap <target_image_url> <source_face_url>

</usage>

<rules>
1. For I2V prompts, translate to English first.
2. The script outputs "Success! Result: <URL>".
3. If the result is an image, render it as `![Result](<URL>)`.
4. If the result is a video, return the raw URL.
</rules>

Files

8 total
Select a file
Select a file to preview.

Comments

Loading comments…