Skillv1.0.9

ClawScan security

NSFW Video Generation — Adult Creative AI Video Models · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

BenignMar 18, 2026, 4:46 AM

Verdict: Benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's requests and code are consistent with its stated purpose (NSFW video generation via Atlas Cloud) and only require a single Atlas Cloud API key, but you should be careful about billing, key scope, and the required age confirmation before use.
Guidance: This skill appears to do what it says: it uses your Atlas Cloud API key to send prompts and media to api.atlascloud.ai and download generated videos. Before installing or running it, consider: (1) Billing and key scope — Atlas Cloud keys grant full access to your account and usage is billed; create a dedicated key and limit the account balance to reduce exposure. (2) Age verification — the SKILL.md requires the agent to confirm the user is 18+; ensure your agent enforces this prompt before generating mature content (autonomous invocation could otherwise run the skill without an explicit confirmation). (3) Legal and policy compliance — verify that generating and storing explicit material is legal and acceptable in your jurisdiction and environment. (4) Data privacy — uploaded local files and prompts are sent to Atlas Cloud; do not upload content you cannot share. Recommended actions: create a separate Atlas account/key with minimal funds, monitor usage regularly, revoke the key when finished, and verify your agent implementation enforces the age-check and upload confirmations.

Review Dimensions

Purpose & Capability: okThe skill name/description (NSFW video generation) matches what it requires and does: it sends prompts/media to api.atlascloud.ai and requires ATLASCLOUD_API_KEY. No unrelated credentials, system binaries, or config paths are requested.
Instruction Scope: noteSKILL.md and the included script limit behavior to listing models, uploading media, submitting generation jobs, polling results, and downloading outputs. The README requires an explicit age confirmation step before first use — that relies on the agent enforcing the SKILL.md instruction. If the agent can invoke skills autonomously, confirm that it will prompt for and record an explicit user confirmation before generating mature content. The script only uploads files when the user runs the upload command and prompts for confirmation before an upload unless bypassed with skip flags.
Install Mechanism: okThere is no install spec (instruction-only installation). A Python script is included but uses only the standard library. Nothing in the manifest attempts to download or execute external installers or place binaries in unusual locations.
Credentials: noteOnly ATLASCLOUD_API_KEY is required, which is appropriate. However, the SKILL.md explicitly states Atlas Cloud keys currently grant access to all models on the account and usage is billed to the account balance — this gives the key substantial power (including cost risk). The skill appropriately recommends using a dedicated key and monitoring balance.
Persistence & Privilege: okThe skill does not request permanent presence (always:false) or modify other skills or system-wide settings. It does not persist credentials itself. Note: autonomous invocation of skills is allowed by default on the platform; that is normal but increases the importance of the SKILL.md age-confirmation requirement and cost controls.