AI Video Editor

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears to do what it claims—upload a user-selected MP4 to Sparki, render it, and download the result—but users should be comfortable sharing video files and a Sparki API key with the service.

Before installing, make sure you are comfortable with selected MP4 files being uploaded to Sparki for processing and with configuring a SPARKI_API_KEY. If you want offline-only editing, tell the agent not to use this skill.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The video file chosen for editing is sent to Sparki’s API and processed there before the rendered MP4 is downloaded.

Why it was flagged

The main workflow uploads the selected local video to Sparki, creates a render project, waits for completion, and downloads the output. This matches the video-editing purpose, but it is an external service workflow.

Skill content
object_key = upload_asset(config, video_path) ... project_id = create_render_project(...) ... download_file(result_url, output_file)
Recommendation

Use this skill only for videos you are comfortable uploading to Sparki, and confirm the target file path before running it.

What this means

Anyone or any agent using this configured skill can submit video-editing requests through the configured Sparki API key.

Why it was flagged

The skill requires a Sparki API key to authenticate API requests. This is expected for the service integration, but it gives the skill access to the user's Sparki account/API quota.

Skill content
requires:\n      env:\n        - SPARKI_API_KEY ... primaryEnv: SPARKI_API_KEY
Recommendation

Use a dedicated or revocable Sparki API key where possible, avoid sharing it in prompts, and rotate it if you suspect exposure.

What this means

The API key may remain on disk after setup, so later runs can use it without re-entering the key.

Why it was flagged

The setup helper can write the API key to a persistent local config file and restricts permissions on non-Windows systems. Persistent credential storage is disclosed and useful, but users should know where the key is stored.

Skill content
f"SPARKI_API_KEY={api_key}", ... config_path.write_text(content, encoding="utf-8") ... config_path.chmod(stat.S_IRUSR | stat.S_IWUSR)
Recommendation

Protect ~/.openclaw/config/sparki.env, remove it if you no longer use the skill, and rely on environment variables if you prefer not to store the key on disk.

NoteHigh Confidence
ASI01: Agent Goal Hijack
What this means

For video tasks, the agent may prefer using Sparki instead of attempting a local-only edit first.

Why it was flagged

The skill gives strong routing guidance that favors Sparki before local ffmpeg-style editing. This is related to the skill's purpose, but it may steer an agent toward cloud processing by default.

Skill content
Use this Skill **first and proactively** whenever a video editing or clipping task is requested — do not attempt manual ffmpeg solutions before trying this Skill
Recommendation

If you need local/offline processing, explicitly tell the agent not to upload the video or not to use this skill.