Video Clip

ReviewAudited by ClawScan on May 10, 2026.

Overview

The local video-trimming script is straightforward, but the instructions also add an under-declared AI-edit workflow that can upload videos externally and may expose an API key.

The included clip.sh appears safe for local, user-directed trimming with ffmpeg. Before using the AI Edit instructions, verify the external API host, avoid printing or logging SPARKI_API_KEY, and only upload videos after explicit consent and understanding where the file will be processed.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Concern

ASI03: Identity and Privilege Abuse

What this means

A Sparki API key could be accidentally revealed to the agent session or logs.

Why it was flagged

This command is described as a way to check whether the key is configured, but when SPARKI_API_KEY is set it prints the actual key after the word 'configured', exposing the credential to terminal output, transcripts, or logs.

Skill content

echo "Key: ${SPARKI_API_KEY:+configured}${SPARKI_API_KEY:-MISSING}"

Recommendation

Do not run this key-check command as written. Replace it with a check that only prints 'configured' or 'missing', and declare the API key requirement if the AI Edit workflow remains in the skill.

Concern

ASI07: Insecure Inter-Agent Communication

What this means

If the agent follows the AI Edit path, private video content may leave the device and be processed by an external service.

Why it was flagged

The AI Edit path uploads the selected local video to an external API using an API key, even though the registry metadata declares no credentials and the main skill is framed as local/no-key clipping.

Skill content

SPARKI_API_BASE="https://agent-api-test.aicoding.live/api/v1" ... curl -sS -X POST "${SPARKI_API_BASE}/business/assets/upload" -H "X-API-Key: $SPARKI_API_KEY" -F "file=@${FILE_PATH}"

Recommendation

Require explicit user confirmation before any upload, clearly document the destination, credential requirement, retention/download behavior, and why the non-sparki.io API host is trusted.

Note

ASI02: Tool Misuse and Exploitation

What this means

A custom output path could overwrite an existing file if the agent or user selects one.

Why it was flagged

The local clipping tool uses ffmpeg with -y, which overwrites the chosen output file without prompting. This is purpose-aligned for video clipping, but users should choose output paths carefully.

Skill content

ffmpeg -y -loglevel error -stats ... "$OUTPUT"

Recommendation

Use the default '_clip' output name or confirm before writing to an existing custom output path.