Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Feed Designs You Video Gen
v1.0.0Create vertical algorithm-control shorts: five equal caption beats across the runtime, UI/data-stream montage (WeryAI). Use for attention-economy critique, d...
⭐ 0· 75·0 current·1 all-time
byparallel world@zoucdr
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
Name/description, required binary (node), and required env (WERYAI_API_KEY) align with a video-generation skill that calls WeryAI. However, the SKILL.md/default-parameters (duration default = 10, generate_audio default = true) conflict with the included script (buildRequestBody sets duration default to 5 and generate_audio default to false). That mismatch is a substantive inconsistency between the documented behavior and the actual implementation.
Instruction Scope
SKILL.md stays within scope for a video-gen skill: it instructs prompt expansion, timing, assets, and use of the bundled CLI script. It requires only https image URLs and WERYAI_API_KEY. There are no instructions to read unrelated system files or extra env vars. The mandatory prompt-confirmation workflow is explicit.
Install Mechanism
There is no install spec (instruction-only) which is low-risk. The skill does include an executable Node script (scripts/video_gen.js) that will be run; the script has no external package downloads and uses Node 18+ built-in fetch. No remote arbitrary-download install steps are present.
Credentials
Only a single credential is required: WERYAI_API_KEY (also declared as primaryEnv). That matches the documented API usage. No unrelated credentials or file paths are requested.
Persistence & Privilege
The skill is not force-included (always: false) and uses normal autonomous invocation defaults. It does not request to modify other skills or system settings.
What to consider before installing
This skill appears to be a legitimate WeryAI video-generation helper and only needs your WERYAI_API_KEY and Node.js. However, there are mismatches between what the SKILL.md promises and what the included script actually does: the documentation says the default duration is 10s and audio generation defaults to true, but the bundled CLI sets duration to 5s and defaults audio to false if not specified. Before installing or relying on this skill, you should: 1) test with --dry-run or run the script locally to confirm actual defaults and behavior, 2) explicitly pass 'duration', 'model', and 'generate_audio' in requests to avoid surprises, 3) verify you trust the endpoint https://api.weryai.com and use an API key with appropriate, limited privileges, and 4) review content-policy/ethical implications if you plan to generate manipulative or targeted content. These inconsistencies look like sloppy documentation/packaging rather than malicious intent, but they could produce unexpected outputs if you assume the SKILL.md defaults.scripts/video_gen.js:467
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk979gjqy2amps94vbyhx10092d83a88g
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📱 Clawdis
Binsnode
EnvWERYAI_API_KEY
Primary envWERYAI_API_KEY