Kling 3.0 — AI Video Generation by Kuaishou

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: kling-video Version: 1.0.4 The skill provides a legitimate interface for AI video generation using Kling models via the Atlas Cloud API. The Python script (scripts/generate_video.py) uses standard libraries to interact with api.atlascloud.ai, correctly handling environment-based credentials and implementing basic path safety for downloads, with no evidence of malicious intent or data exfiltration.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

An unintended or overly broad generation request could consume Atlas Cloud credits or create billable API usage.

Why it was flagged

The skill's main action submits paid video-generation jobs. This is expected for the stated purpose, but cost-bearing tool use should be explicitly user-approved.

Skill content
API usage incurs charges per second based on the model selected.
Recommendation

Before running generation, confirm the selected model, duration, resolution, and expected cost; avoid enabling automatic use without review.

What this means

Anyone or anything using this environment variable can act on the connected Atlas Cloud account and may incur charges.

Why it was flagged

The script reads an Atlas Cloud API key from the environment and sends it as a bearer token for authenticated API requests.

Skill content
key = os.environ.get("ATLASCLOUD_API_KEY") ... "Authorization": f"Bearer {get_api_key()}"
Recommendation

Use a dedicated, limited-scope API key if available, keep it out of shared logs or shells, and monitor Atlas Cloud usage.

What this means

Prompts, image links, video links, and uploaded media may be processed by Atlas Cloud outside the local environment.

Why it was flagged

The artifacts clearly disclose an external provider data flow for prompts and media references, which is central to the skill's function but can include private or sensitive content.

Skill content
This skill sends text prompts, image URLs, and video URLs to the Atlas Cloud API (`api.atlascloud.ai`) for video generation and editing.
Recommendation

Do not send confidential, regulated, or private media unless Atlas Cloud's terms and data-handling policies are acceptable.

What this means

Users may have less confidence that the referenced repository is specifically maintained for this Kling video skill.

Why it was flagged

The declared source repository name appears unrelated to the Kling video skill name, creating a small provenance and branding ambiguity even though the included script is purpose-aligned.

Skill content
name: kling-video ... source: "https://github.com/AtlasCloudAI/nano-banana-2-skill"
Recommendation

Verify the repository contents, owner, and release history before trusting the skill with an API key or media uploads.