v1.0.5

Cute Pet Healing Video

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 7:53 AM.

Analysis

This skill is coherent for generating WeryAI pet videos, but it requires a WeryAI API key and can send prompts or explicitly chosen local images to WeryAI.

GuidanceInstall only if you are comfortable giving this bundled Node script access to WERYAI_API_KEY. Prefer HTTPS image URLs, avoid sensitive local files, review the script if provenance matters to you, and confirm each paid generation request before running it.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceHighStatusNote

metadata

Source: unknown
Homepage: none

The skill includes executable Node code and requires a paid API credential, but the registry metadata does not provide a source repository or homepage for provenance.

User impactYou have less external provenance to rely on when deciding whether to trust the bundled script with your API key.

RecommendationReview scripts/video_gen.js before use, and prefer running it in a short-lived or isolated environment if you are unsure of the publisher.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

resources/WERYAI_VIDEO_API.md

`WERYAI_API_KEY` (required for `models`, generation, and `status`, except `--dry-run`): bearer token for HTTPS requests.

The skill needs an account API key to create, query, and wait for WeryAI tasks; this is expected for the integration and is disclosed.

User impactUsing the skill can act on your WeryAI account and may consume paid credits for successful generation runs.

RecommendationUse a scoped or dedicated WeryAI key if available, keep the key out of files and logs, and confirm the generation parameters before running paid tasks.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

resources/WERYAI_VIDEO_API.md

Local files are uploaded first, then the returned public URL is sent to the image-to-video API.

The documented image-to-video flow can send user prompts and opted-in local image files to WeryAI-hosted services.

User impactAny prompt text or local image you provide may be processed by WeryAI, and local files become uploaded to obtain a public URL for generation.

RecommendationPrefer public HTTPS image URLs, and only use local file paths after explicitly confirming the exact file is intended for upload and contains no sensitive content.