Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Byted Las Vlm Video
v1.0.0Video content understanding operator (las_vlm_video) via Doubao models. Use this skill when user needs to: - Analyze/describe video content with natural lang...
⭐ 0· 57·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's code and SKILL.md implement a video-understanding call to operator.las.<region>.volces.com and require an LAS_API_KEY — this matches the described purpose. However the registry metadata claims no required env vars while SKILL.md and scripts/skill.py explicitly require LAS_API_KEY (and optionally LAS_REGION/LAS_API_BASE). That metadata mismatch is misleading and should be fixed.
Instruction Scope
Runtime instructions and the Python script stay within the stated scope: they validate the video URL (blocking private IPs), build a JSON payload containing the video_url and prompt, and POST to the LAS operator endpoint. The script reads LAS_API_KEY from the environment or a local env.sh file in the current working directory; it does not attempt to read arbitrary files or other credentials.
Install Mechanism
There is no install specification (instruction-only) which is lower risk, but the bundled script imports the 'requests' Python module and has no declared dependency list. The skill may fail at runtime if 'requests' is not present. Also the registry metadata omitted the LAS_API_KEY requirement. No third‑party downloads or remote installers are used.
Credentials
The only secret the skill needs is LAS_API_KEY (and optional region/API_BASE env vars) which is proportionate to calling the LAS service. However the registry metadata does not declare LAS_API_KEY as required — this is an inconsistency. The script will also read a local env.sh in the current working directory for LAS_API_KEY, which could accidentally pick up an unexpected file; it only parses lines containing LAS_API_KEY but reading configuration files from the CWD is a minor risk to be aware of.
Persistence & Privilege
The skill does not request persistent or platform-wide privileges (always is false). It does not modify other skills or system settings. It only reads a local env.sh (if present) and writes user-specified output files.
What to consider before installing
Before installing: (1) be aware this skill requires an LAS_API_KEY even though the registry metadata omitted it — supply the key via environment variable LAS_API_KEY or a local env.sh in the working directory; (2) review and confirm the endpoint operator.las.<region>.volces.com is the expected service; (3) the bundled script uses the Python 'requests' library but no dependencies are declared — run in an environment with requests installed or add a dependency step; (4) because the script reads env.sh from the current directory, avoid running it from directories that contain other sensitive environment files; (5) run with a limited/replaceable API key or in an isolated environment first (use the script's dry-run mode) to observe the exact payloads it sends. The main concerns are metadata inconsistency and the cwd env.sh behaviour — not obvious malicious activity, but verify the API target and key handling before use.Like a lobster shell, security has layers — review code before you run it.
latestvk97e08y4xkgjp4j6r43jkp2mg583j9k5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.