Visla AI Video Creation

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: visla Version: 1.1.0 The Visla skill bundle provides a legitimate interface for generating AI videos via the Visla API. Both the Python (`visla_cli.py`) and Bash (`visla_cli.sh`) scripts implement security best practices, including HMAC-SHA256 request signing and explicit checks to prevent path traversal and access to sensitive system directories (e.g., /etc, /proc, C:\Windows). The `SKILL.md` instructions specifically direct the AI agent to obtain user consent before reading credentials from the local filesystem and warn against leaking secrets in responses.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

The skill can act through the user's Visla API credentials, including creating videos and checking account information.

Why it was flagged

The skill requires a Visla API key and secret, which are sensitive credentials that allow use of the user's Visla account.

Skill content

requires:
      env: [ "VISLA_API_KEY", "VISLA_API_SECRET" ]
    primaryEnv: "VISLA_API_KEY"

Recommendation

Use a Visla API key intended for this purpose, keep the secret out of chat responses, and revoke or rotate the key if you no longer trust the skill.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Documents, scripts, audio, images, or webpage content you provide may be uploaded to Visla's service.

Why it was flagged

The skill is designed to send user-selected scripts, documents, URLs, media, or related content to Visla for video generation; the artifact explicitly warns about sensitive data.

Skill content

Only process local files (scripts/docs) explicitly provided by the user, and remind users to avoid uploading sensitive data.

Recommendation

Only use files and URLs you are comfortable sending to Visla, and avoid confidential, regulated, or personal data unless your Visla account and policies allow it.

Note

ASI05: Unexpected Code Execution

What this means

If the saved credential file contained unexpected shell commands, sourcing it could run those commands.

Why it was flagged

Sourcing a file in Bash executes its shell contents, not just reads credential variables; this is a common setup shortcut but should be limited to a trusted credential file.

Skill content

# With user consent, you may source ~/.config/visla/.credentials

Recommendation

Prefer environment variables or the Python credential parser, and only allow sourcing ~/.config/visla/.credentials if you created or trust that file.