Back to skill
Skillv0.1.0
ClawScan security
Canvas Claw · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 7, 2026, 8:31 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, runtime instructions, and required environment variables are internally consistent with a client for an AI-video-agent service; nothing in the package indicates hidden or unrelated credential access or covert behavior.
- Guidance
- This package appears to be a straightforward client/CLI for an AI-video-agent backend. Before installing or running it: (1) Only set AI_VIDEO_AGENT_BASE_URL to a trusted service — local files you pass (reference images, first frames) will be uploaded to that service. (2) Treat AI_VIDEO_AGENT_TOKEN as a secret and avoid pasting it into logs; the bundled login helper prints a token to stdout, which could be captured in terminal history or CI logs. (3) Result URLs returned by the service will be downloaded and saved locally (./output). (4) There is a minor metadata mismatch: the registry notes 'instruction-only', but the package includes a full Python client and scripts — this just means the skill contains code (no installer), not that it reaches out to unexpected endpoints. If you do not trust the AI-video-agent server you configure, do not provide any sensitive local files or tokens.
Review Dimensions
- Purpose & Capability
- okName/description (image/video generation via AI-video-agent) match the code and declared requirements. Required binary (python3) and required env vars (AI_VIDEO_AGENT_BASE_URL, AI_VIDEO_AGENT_TOKEN, AI_VIDEO_AGENT_SITE_ID) are appropriate and used by the client and scripts.
- Instruction Scope
- noteRuntime instructions and scripts make HTTP requests to the configured AI-video-agent endpoints, upload any local files you pass (materialize-binary), and download result URLs into the local ./output directory. This is expected for the stated purpose, but it means any local file path you provide will be read and uploaded to the configured remote service and result URLs will be fetched and written to disk. The login helper prints the token to stdout (convenient but can be leaked via logs).
- Install Mechanism
- okNo install/download spec is present; the package is runnable as Python scripts. There is no external archive download or execution-from-remote step in the manifest.
- Credentials
- okOnly the AI-video-agent-specific env vars are required. The primary credential is the service token (AI_VIDEO_AGENT_TOKEN). No unrelated secrets or system credentials are requested.
- Persistence & Privilege
- okSkill does not request 'always: true' or modify other skills. It runs as normal user-invocable/autonomous skill and does not attempt to persist or escalate privileges in the provided code.