Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marks this skill suspicious because it flags external sharing of creative material without a clear privacy warning, and some bundled references were only partly analyzed; the scan does not establish malicious intent.
Consider the suspicious verdict before installing. Avoid submitting confidential prompts, moodboards, or images to external services unless you have reviewed and accepted where that content will go. The scan was partial: 10 of 13 components were fully inspected, while three were only partly inspected because of parser limits, so the results are incomplete.
Referenced artifact was not completely inspected
(Unsplash, Pexels, The Met, Poly Haven, approved stills). Section 2 of `references/links.md` lists the terms.
Referenced artifact was not completely inspected
8. **Use the links.** `references/links.md` has every database, tool, vendor guide, benchmark and creator post
Referenced artifact was not completely inspected
Open: `references/links.md` §2 References and Style codes, §3, §6 "Moodboards overall".
Referenced artifact was not completely inspected
has every tip from the 1,540 posts read, with links. Vendor-specific wording is in `references/links.md` §4.
Referenced artifact was not completely inspected
`references/links.md` §4; per-shot prompting: varg-video-prompting.
Referenced artifact was not completely inspected
- `references/links.md`: every link (databases, X tools, 14 vendor guides, research, creator posts, varg skills)
Referenced artifact was not completely inspected
board.html the board as one page to look at (copy assets/board.html, fill its JSON)
Referenced artifact was not completely inspected
Copy `assets/board.html` next to `moodboard.md` and fill the JSON block at the top (same fields as the template).
Referenced artifact was not completely inspected
- `assets/board.html`: the visual board template
Suspicious Unicode normalization or mixed-script content
The documented npx command can download and execute an unpinned version of the skills package with the installing user's privileges. This is a conditional supply-chain exposure rather than an MCP server configuration issue: compromise of a subsequently resolved package release could execute attacker code.
The README advertises test-still generation and names external services, but does not explicitly explain that creative prompts and any attached references leave the user's environment. For confidential campaigns or unreleased products, proceeding without informed authorization could disclose sensitive creative material; naming the API alone does not establish that authorization.
Suspicious Unicode normalization or mixed-script content
The workflow directs the agent to submit moodboard lines to external image models and potentially attach reference images, without a privacy-specific authorization gate. Quoting the price and obtaining later video approval do not authorize disclosure of confidential brand, subject, or product information before still generation.
Suspicious Unicode normalization or mixed-script content
Suspicious Unicode normalization or mixed-script content
Suspicious Unicode normalization or mixed-script content
The tip explicitly instructs the agent to feed a reference frame to Claude, rather than merely listing an available tool. It does not warn that this shares image content with an external service, which could expose private or confidential material in user-provided frames.
Suspicious Unicode normalization or mixed-script content
Suspicious Unicode normalization or mixed-script content
The copy-paste workflow directs external generation using moodboard content without requiring confirmation that the material may be shared with the receiving services. This can expose confidential creative briefs or product details, and the requested price notice addresses spending rather than privacy.
Suspicious Unicode normalization or mixed-script content
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
ype + Palette row. | live |
| 18 | [Refero](https://doc.refero.design/mcp/getting-started.md) · also: [1](https://doc.refero.design/mcp/data-model), [2](https://doc.refero.design/mcp/business) | Web sites, iOS apps, styles, screens and flows (counts not stated in the docs opened). | refero_search_site, refero_search_app, screens and flows with platform web/ios. | Paid Pro, Team or Lifetime required for MCP; up to 8,000 MCP calls/month per user; business use $0.001/request, $2,000 minimum. | MCP https://api.refero.design/mcp (OAuth or Bearer). | Docs: "Styles are guidance, not templates." | App-UI mockups inside videos: find real screens and flows to base fake UI on. | live |
| 19 | [Mobbin](https://mobbin.com) · also: [1](https://mobbin.com/pricing.md) | 'Over 600,000 screens' from shipped apps and sites. | Apps, web apps, sites, screen text, patterns, UI elements; filters by product, platform, industry, category. | Free (limited); Pro $10/month yearly ($15 quarterly); Team $16/member/
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
ce still, let Colormind fill the rest, write the hex codes onto the board and into image prompts. | live |
| 2 | [Huemint (API)](https://huemint.com/about/) · also: [1](https://huemint.com) | ML palette generator (transformer, diffusion, random modes), 2-12 colours per palette, up to 50 results per request (transformer) or 5 (diffusion). | Lock colours as hex, set an adjacency (contrast) matrix between colour roles and a temperature 0-2.4. | Free web tool; no API price stated. | Public API POST https://api.huemint.com/color (responded live 2026-11-03). | "Feel free to use the public API for non-commercial applications, but the service is provided 'as is' and uptime is not guaranteed." | Generate background / text / accent roles with a set contrast for title cards and lower thirds. | live |
| 3 | [Coolors](https://coolors.co) · also: [1](https://coolors.co/api) | Palette generator; '10M+ of ready color schemes'; '8+ million creative minds'. Also image picker, contrast checker, gradients
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| # | Name | What it holds | How to search | Price | Agent access | Terms | Use it for | Status |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| 1 | [Poly Haven (HDRIs, textures, models)](https://polyhaven.com) · also: [1](https://polyhaven.com/license), [2](https://polyhaven.com/our-api), [3](https://polyhaven.com/hdris), [4](https://api.polyhaven.com/assets?type=hdris) | 997 HDRIs, 869 textures, 521 models (counted via api.polyhaven.com on 2026-11-03); HDRIs up to 16k, textures at least 8k. | HDRI categories (Studio, Interiors, Pure Skies, Streets & Town, Coast & Water, Industrial...), sort Hot / Top / Downloads / Latest; API /assets?type=hdris/textures/models. | Free, CC0, no signup (Patreon-funded). | Public JSON API, no key; requires a unique User-Agent. Tested live. | "You can use our assets for any purpose, including commercial work." API condition: if you use the live API in a product, make clear assets come from Poly Haven ('Powered by Poly Haven'). Site ToS bans '