Ai Video Generation Skills

• Outcome: Pass
• Latest audit: May 29, 2026, 8:21 PM
• Version:
  1.0.1

Overview

This skill is a straightforward Pixwith media-generation connector, with expected API-key setup and user-selected image uploads.

Install this only if you intend to use Pixwith through OpenClaw. Treat the Pixwith API key as a secret, store it only in local MCP settings, review credit costs before expensive jobs, and avoid uploading sensitive images or prompts unless you are comfortable sending them to Pixwith.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill tells users to generate and paste an API key into configuration but does not warn that the key is a secret, should not be shared in chat, should be stored only in trusted local MCP settings, and should be rotated if exposed. In an agent setting, omission of credential-handling guidance increases the chance users leak the key into prompts, screenshots, logs, or copied configs.

VirusTotal

66/66 vendors flagged this skill as clean.