v0.1.0

Hydraulic Crush Video

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 7:54 AM.

Analysis

This appears to be a coherent WeryAI video-generation skill that uses a declared API key and external API, so users should review credential and credit use before running it.

GuidanceInstall this only if you are comfortable giving it access to a WeryAI API key and sending prompts or public image URLs to WeryAI. Use a separate key/account where practical, review the generated prompt and parameters, and confirm only when you intend to spend credits.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

Each successful `wait` run consumes WeryAI credits; re-running creates new paid tasks. ... wait for **confirm** or edits.

The workflow can submit paid generation tasks, but the artifact explicitly discloses the cost impact and requires user confirmation before submission.

User impactAccidental confirmation or repeated runs could spend credits by creating new video-generation tasks.

RecommendationReview the pre-submit parameter table carefully, especially prompt, model, duration, and image URLs, before confirming.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceHighStatusNote

metadata

Source: unknown; Homepage: none

The registry metadata does not provide a source repository or homepage for the included runnable script, which limits provenance review even though no install script or dependency chain is shown.

User impactUsers have less external provenance information to verify who maintains the skill or where updates come from.

RecommendationReview the included script before first use and prefer installing from publishers or sources you trust.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

scripts/video_gen.js

const apiKey = (process.env.WERYAI_API_KEY || '').trim(); ... Authorization: `Bearer ${apiKey}`

The skill reads a WeryAI API key from the environment and sends it as an authorization token, which is expected for the service but grants account/API access.

User impactRunning the skill uses the user's WeryAI credential and may consume the user's WeryAI account credits.

RecommendationUse a dedicated or limited WeryAI key/account if possible, keep the key out of repositories, and approve only requests you intend to pay for.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

scripts/video_gen.js

const BASE_URL = 'https://api.weryai.com'; ... const body = { prompt: params.prompt, model, duration: Number(params.duration) || 5 }; if (params.image) body.image = params.image;

The script sends user prompts and optional image URLs to an external WeryAI API endpoint, which is expected for cloud video generation but is still an external data flow.

User impactPrompt text and public image URLs submitted through the skill will be shared with WeryAI for processing.

RecommendationDo not include sensitive, private, or confidential information in prompts or image URLs unless you are comfortable sharing it with WeryAI.