Skip to content
← Registry
Trust Report

ai-video-generation

Generate AI videos with Google Veo, Seedance, Wan, Grok and 40+ models via inference.sh CLI. Models: Veo 3.1, Veo 3, Seedance 1.5 Pro, Wan 2.5, Grok Imagine Video, OmniHuman, Fabric, HunyuanVideo. Capabilities: text-to-video, image-to-video, lipsync, avatar animation, video upscaling, foley sound. Use for: social media videos, marketing content, explainer videos, product demos, AI avatars. Triggers: video generation, ai video, text to video, image to video, veo, animate image, video from image, ai animation, video generator, generate video, t2v, i2v, ai video maker, create video with ai, runway alternative, pika alternative, sora alternative, kling alternative

73
SUSPICIOUS
Format: openclawScanner: v0.8.0Duration: 27msScanned: 8d ago · May 2, 12:22 PMSource →
Embed this badge
AgentVerus SUSPICIOUS 73AgentVerus SUSPICIOUS 73AgentVerus SUSPICIOUS 73
[![AgentVerus](https://agentverus.ai/api/v1/skill/6498427f-8e33-4fa2-ba4b-73100921fb8c/badge)](https://agentverus.ai/skill/6498427f-8e33-4fa2-ba4b-73100921fb8c)
Community Discussion

Community Comments

Public comments are the active feedback surface on skill reports right now. Use them to share implementation notes, edge cases, and operator context.

0 comments

Sign in to comment on this skill

No comments yet. Be the first to share your thoughts.

Continue the workflow

Keep this report moving through the activation path: rescan from the submit flow, capture real-world interactions, and wire the trust endpoint into your automation.

https://agentverus.ai/api/v1/skill/6498427f-8e33-4fa2-ba4b-73100921fb8c/trust
Personalized next commands

Use these current-skill command blocks to keep this exact report moving through your workflow.

Record an interaction
curl -X POST https://agentverus.ai/api/v1/interactions \
  -H "Authorization: Bearer at_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"agentPlatform":"openclaw","skillId":"6498427f-8e33-4fa2-ba4b-73100921fb8c","interactedAt":"2026-03-15T12:00:00Z","outcome":"success"}'
Fetch trust JSON
curl https://agentverus.ai/api/v1/skill/6498427f-8e33-4fa2-ba4b-73100921fb8c/trust

Category Scores

68
Permissions
100
Injection
31
Dependencies
70
Behavioral
70
Content
80
Code Safety

Findings (23)

highCapability contract mismatch: inferred command execution is not declared-12

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: curl -fsSL https://cli.inference.sh | sh

Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03
highSuspicious install pattern: download and execute from remote URL-25

The skill instructs users to download and execute code from a remote URL, a common supply-chain attack vector.

curl -fsSL https://cli.inference.sh | sh

Remove curl-pipe-to-shell patterns. Provide dependencies through safe, verifiable channels.

behavioralASST-02
highDownload-and-execute pattern (curl|wget pipe to shell)-20

Piping a downloaded script directly to a shell interpreter. This executes remote code without verification — a classic supply chain attack vector.

curl -fsSL https://cli.inference.sh | sh && infsh login

Review the code block starting at line 15. Ensure this pattern is necessary and does not pose a security risk.

code-safetyASST-04
mediumCapability contract mismatch: inferred file read is not declared-6

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: examples/

Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03
mediumCapability contract mismatch: inferred network access is not declared-6

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: https://inference.sh

Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-04
mediumCapability contract mismatch: inferred package bootstrap is not declared-8

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: npx skills

Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03
mediumMedia artifact handoff dependency-8

The skill depends on local images, videos, thumbnails, or other media artifacts being passed into remote or browser-driven workflows, expanding the data-handoff surface.

Image generation

Review which external services or providers the skill depends on, what data crosses that boundary, and whether the dependency is necessary for the intended workflow.

dependenciesASST-04
mediumDownload-and-execute pattern detected (inside code block)-8

The skill contains a download-and-execute pattern inside a code block. Verify the URL is trustworthy.

curl -fsSL https://cli.inference.sh | sh

Pin the installer to a specific version or hash. Consider bundling dependencies instead.

dependenciesASST-04
mediumMany external URLs referenced (16)-8

The skill references 16 external URLs and also discusses auth/API/payment workflows, which increases the chance that sensitive operations depend on many remote endpoints.

URLs: https://inference.sh, https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kg2c0egyg243mnyth4y6g51q.jpeg, https://cli.inference.sh, https://dist.inference.sh/cli/checksums.txt, https://your-image.jpg...

Minimize external dependencies to reduce supply chain risk.

dependenciesASST-04
mediumUnknown external reference-8

The skill references an unknown external domain which is classified as medium risk. Merged overlapping signals from the repeated finding family: - Unknown external reference

https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kg2c0egyg243mnyth4y6g51q.jpeg

Verify that this external dependency is trustworthy and necessary.

dependenciesASST-04
mediumPackage bootstrap execution detected (inside code block)-5

Found package bootstrap execution pattern: "npx skills"

npx skills add inference-sh/skills@inference-sh

Surface package bootstrap commands for review. Ephemeral package execution and install-time dependency pulls increase supply-chain risk, especially when versions are not pinned or provenance is unclear.

behavioralASST-04
lowUnknown external reference-5

The skill references an unknown external domain which is classified as low risk.

https://inference.sh

Verify that this external dependency is trustworthy and necessary.

dependenciesASST-04
lowUnknown external reference

The skill references an unknown external domain which is classified as low risk.

https://dist.inference.sh/cli/checksums.txt

Verify that this external dependency is trustworthy and necessary.

dependenciesASST-04
lowUnknown external reference

The skill references an unknown external domain which is classified as low risk.

https://your-image.jpg

Verify that this external dependency is trustworthy and necessary.

dependenciesASST-04
lowUnknown external reference

The skill references an unknown external domain which is classified as low risk.

https://portrait.jpg

Verify that this external dependency is trustworthy and necessary.

dependenciesASST-04
lowUnknown external reference

The skill references an unknown external domain which is classified as low risk.

https://speech.mp3

Verify that this external dependency is trustworthy and necessary.

dependenciesASST-04
lowUnknown external reference

The skill references an unknown external domain which is classified as low risk.

https://face.jpg

Verify that this external dependency is trustworthy and necessary.

dependenciesASST-04
lowUnknown external reference

The skill references an unknown external domain which is classified as low risk.

https://audio.mp3

Verify that this external dependency is trustworthy and necessary.

dependenciesASST-04
lowUnknown external reference

The skill references an unknown external domain which is classified as low risk.

https://

Verify that this external dependency is trustworthy and necessary.

dependenciesASST-04
lowUnknown external reference

The skill references an unknown external domain which is classified as low risk.

https://silent-video.mp4

Verify that this external dependency is trustworthy and necessary.

dependenciesASST-04
lowUnknown external reference

The skill references an unknown external domain which is classified as low risk.

https://clip1.mp4

Verify that this external dependency is trustworthy and necessary.

dependenciesASST-04
lowUnknown external reference

The skill references an unknown external domain which is classified as low risk.

https://clip2.mp4

Verify that this external dependency is trustworthy and necessary.

dependenciesASST-04
lowNo explicit safety boundaries-10

The skill does not include explicit safety boundaries defining what it should NOT do.

No safety boundary patterns found

Add a 'Safety Boundaries' section listing what the skill must NOT do (e.g., no file deletion, no network access beyond needed APIs).

contentASST-09