Video Resize

ReviewAudited by ClawScan on May 10, 2026.

Overview

The local resize script is straightforward, but the optional AI-edit instructions can print your API key and upload videos to an external service.

The core resize.sh script appears coherent for local video resizing with ffmpeg. Before installing or using the optional AI Edit instructions, do not run the API-key check as written, verify the external API endpoint, and only upload videos you are comfortable sending to a third-party service.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If you give an output filename that already exists, that file may be replaced.

Why it was flagged

The script writes a resized video to a user-chosen output path and uses ffmpeg's -y flag, which overwrites an existing output file without prompting. This is expected for a resize tool but users should choose output paths carefully.

Skill content

ffmpeg -y -loglevel error -stats ... "$OUTPUT"

Recommendation

Use a new output filename or back up important files before running the resize command.

Concern

ASI03: Identity and Privilege Abuse

What this means

Your Sparki API key could be displayed and captured by logs or anyone with access to the session output.

Why it was flagged

When SPARKI_API_KEY is set, this shell expansion prints the actual key after the word 'configured', exposing the credential in terminal output, agent transcripts, or logs.

Skill content

echo "Key: ${SPARKI_API_KEY:+configured}${SPARKI_API_KEY:-MISSING}"

Recommendation

Do not run this check as written. Replace it with a non-revealing check such as printing only 'configured' or 'missing', and rotate the key if it has already been exposed.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Videos sent through AI Edit leave your machine and are processed by an external service.

Why it was flagged

The optional AI Edit workflow uploads the selected video file to an external API using SPARKI_API_KEY. This is disclosed and purpose-aligned for AI editing, but it is materially different from the local-only resize path.

Skill content

SPARKI_API_BASE="https://agent-api-test.aicoding.live/api/v1" ... -F "file=@${FILE_PATH}"

Recommendation

Use the local resize script for private/local-only work. Only use AI Edit when you intentionally want cloud processing and are comfortable with the destination service and its data handling.