v0.1.0

Fairytale Dream Transform Video Gen Seedance2.0

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 7:54 AM.

Analysis

This is a coherent WeryAI video-generation skill, but it uses your WeryAI API key, sends prompts/image URLs to WeryAI, and may consume paid credits.

GuidanceInstall only if you trust this unknown-source skill with a WeryAI API key. Use a limited or disposable key where possible, verify the confirmation table before each run, ensure the model is SEEDANCE_2_0, and avoid submitting sensitive prompts or private images.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

The script does not enforce this skill's allowed model in code: you must set `"model":"SEEDANCE_2_0"` ... Each `wait` run may consume credits; re-run creates new paid tasks.

The script can submit paid generation tasks, while the Seedance-only restriction depends on the caller following the documented workflow.

User impactIf the confirmation step is skipped or the JSON is edited incorrectly, the skill could use the wrong model or create extra paid tasks.

RecommendationBefore confirming, verify the model is SEEDANCE_2_0, check duration/resolution/audio settings, and avoid rerunning unless you intend to spend additional credits.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceHighStatusNote

metadata

Source: unknown; Homepage: none

The registry metadata does not provide a source repository or homepage for independent provenance review.

User impactIt may be harder to verify who maintains the skill or compare the bundled script against an upstream source.

RecommendationReview the included script before use and install only if you trust the publisher and WeryAI integration.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityMediumConfidenceHighStatusNote

resources/WERYAI_VIDEO_API.md

`WERYAI_API_KEY` (required for `models`, generation, and `status`, except `--dry-run`): bearer token for HTTPS requests.

The skill requires a service credential and uses it as a bearer token for WeryAI requests, which is expected for the purpose but grants account/credit authority.

User impactAnyone using the skill must provide a WeryAI API key that can submit jobs and may spend credits.

RecommendationUse a dedicated or credit-limited WeryAI key, avoid sharing it in prompts or files, and revoke/rotate it if you no longer trust the skill.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

API hosts (fixed in `video_gen.js`): Video tasks use `https://api.weryai.com`; the models list uses `https://api-growth-agent.weryai.com` ... image inputs must be public `https` URLs

The artifacts clearly disclose that prompts and public image URLs are sent to external WeryAI API hosts.

User impactText prompts and any supplied public image URLs will be processed by WeryAI, so sensitive personal or confidential content may leave the local environment.

RecommendationDo not submit private images, confidential prompts, or URLs containing secrets unless you are comfortable sharing them with WeryAI.