TCM Video Factory

• Verdict: Advisory
• Analyzed: May 10, 2026, 6:36 AM
• Findings: 0
• Version: 1.0.0
• Reason codes: None
• Engine: v2.4.23

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

NoteHigh Confidence

What this means

Using this skill may consume Perplexity API quota or incur charges tied to the configured API key.

Why it was flagged

The skill uses a Perplexity API key to authenticate requests to Perplexity. This is expected for the stated purpose and is not logged or sent elsewhere in the provided code, but it is still account-level credential use.

Skill content

const apiKey = process.env.PERPLEXITY_API_KEY; ... fetch('https://api.perplexity.ai/chat/completions', { ... 'Authorization': `Bearer ${apiKey}` ... })

Recommendation

Use a dedicated or restricted Perplexity API key where possible, keep it in your environment rather than hardcoding it, and rotate it if you suspect it was exposed.