TCM Video Factory

• Risk level: Low
• Analyzed: May 10, 2026, 6:37 AM
• Findings: 1
• Version: 1.0.0

Overview

This skill appears to do what it claims: it uses a Perplexity API key to generate a local Markdown video production plan, with no evidence of hidden data access or exfiltration.

Before installing, confirm you are comfortable giving the skill access to a Perplexity API key and sending your requested video topics to Perplexity. Review generated health claims before publishing them.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

Note

What this means

Using this skill may consume Perplexity API quota or incur charges tied to the configured API key.

Why it was flagged

The skill uses a Perplexity API key to authenticate requests to Perplexity. This is expected for the stated purpose and is not logged or sent elsewhere in the provided code, but it is still account-level credential use.

Skill content

const apiKey = process.env.PERPLEXITY_API_KEY; ... fetch('https://api.perplexity.ai/chat/completions', { ... 'Authorization': `Bearer ${apiKey}` ... })

Recommendation

Use a dedicated or restricted Perplexity API key where possible, keep it in your environment rather than hardcoding it, and rotate it if you suspect it was exposed.