WayinVideo - AI Clipping

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

You have less external provenance information to confirm who maintains the code.

Why it was flagged

The provided registry metadata does not identify a source repository or homepage for the skill, even though it includes runnable Python scripts.

Skill content
Source: unknown
Homepage: none
Recommendation

Install only if you trust the registry publisher and the included script contents.

What this means

If you use the skill on a local file, that video is sent to WayinVideo for processing.

Why it was flagged

The upload helper requests a WayinVideo upload URL and then uploads the selected local video file to that remote destination.

Skill content
init_url = "https://wayinvideo-api.wayin.ai/api/v2/upload/single-file" ... with open(file_path, 'rb') as f: ... urllib.request.Request(upload_url, data=f, headers=upload_headers, method="PUT")
Recommendation

Only provide video files or URLs you intend to process with WayinVideo, and avoid using private or sensitive media unless that is acceptable.

What this means

The skill can submit clipping jobs under the WayinVideo account associated with that API key.

Why it was flagged

The script uses the WAYIN_API_KEY environment variable as a bearer token for WayinVideo API requests, which is expected for this integration.

Skill content
API_KEY = os.environ.get("WAYIN_API_KEY") ... "Authorization": f"Bearer {API_KEY}"
Recommendation

Use a dedicated, revocable API key if possible and do not expose the key in shared logs or workspaces.

What this means

Result files in your workspace may reveal information about the processed video or include temporary links to generated clips.

Why it was flagged

Polling results are written back into a local JSON file, which may contain clip metadata, generated content, and export links.

Skill content
data["api_response"] = api_response ... json.dump(data, f, ensure_ascii=False, indent=2)
Recommendation

Store result files in a private directory, review them before sharing, and delete them when no longer needed.