Tianshu Wan Video

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a straightforward Alibaba DashScope video-generation wrapper, but it will use your DashScope API key and send prompts or image URLs to Alibaba’s API.

This skill looks coherent and purpose-aligned. Before installing or using it, make sure you are comfortable providing a DashScope API key and sending the video prompt and any image URL to Alibaba’s DashScope service.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone using this skill must provide a valid DashScope API key, and generated requests may consume quota or incur provider costs.

Why it was flagged

The script reads the DashScope API key from the environment and uses it as a Bearer token for provider API calls.

Skill content

const apiKey = process.env.DASHSCOPE_API_KEY; ... Authorization: `Bearer ${apiKey}`

Recommendation

Use a dedicated DashScope key if possible, monitor usage, and do not expose the key in prompts, logs, or shared environments.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Prompts and provided image URLs are shared with Alibaba’s service to generate the video.

Why it was flagged

The script sends the user prompt and, for image-to-video, the image URL to Alibaba DashScope’s external API.

Skill content

const BASE = 'https://dashscope.aliyuncs.com/api/v1'; ... body: JSON.stringify({ model: 'wan2.6-t2v', input, parameters: ... })

Recommendation

Avoid submitting private, confidential, or sensitive image URLs or prompts unless you are comfortable sharing them with the DashScope provider.