拟人动物化妆变身视频

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a purpose-aligned WeryAI video-generation skill, but it uses a provider API key and sends generation prompts or optional image inputs to WeryAI.

Before installing, verify that you trust the WeryAI endpoint, set only the intended WERYAI_API_KEY, and do not submit sensitive prompts or private images unless you are comfortable with them being processed by the provider.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill can use the user's WeryAI account and may consume account credits when the user confirms generation.

Why it was flagged

The helper script requires a provider API key and sends it in the Authorization header for WeryAI requests. This is purpose-aligned, but it is still credential use that users should notice.

Skill content

WERYAI_API_KEY（models / 生成 / status 必填；--dry-run 除外） ... Authorization: `Bearer ${apiKey}`

Recommendation

Use a dedicated WeryAI API key if possible, keep it private, and confirm that WERYAI_BASE_URL points to the legitimate provider endpoint before running the skill.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Any prompt text or image URLs provided for generation may be processed by WeryAI.

Why it was flagged

Generation prompts and optional image inputs are packaged into a request body and sent to the external WeryAI API.

Skill content

res = await apiRequest('POST', pathMap[mode], body, apiKey); ... if (params.image) body.image = params.image; if (params.images) body.images = params.images.slice(0, 3);

Recommendation

Avoid including private, sensitive, or non-consensual images or details in prompts unless you are comfortable sending them to WeryAI.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users have less registry-level information for verifying the origin and required environment setup of the helper script.

Why it was flagged

The package has limited provenance metadata and does not declare the WERYAI_API_KEY that the SKILL.md and script say is needed.

Skill content

Source: unknown; Homepage: none; Required env vars: none

Recommendation

Review the bundled script before use and ensure the expected WeryAI credential is supplied only in a trusted environment.