openclaw-support

Pass

Audited by Gen Agent Trust Hub on Apr 5, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill's setup instructions involve downloading a markdown file from the vendor's static asset server.
  • Evidence: curl -sL https://static.clipcat.ai/public/skills/SKILL.md -o ~/.openclaw/skills/clipcat-ai/SKILL.md in README.md.
  • [COMMAND_EXECUTION]: The skill defines several API interactions using curl to manage video creation tasks.
  • Evidence: Multiple curl commands in SKILL.md targeting https://clipcat.ai/api/openclaw/* endpoints.
  • [CREDENTIALS_UNSAFE]: The skill correctly uses environment variables for API authentication.
  • Evidence: Reference to CLIPCAT_API_KEY in SKILL.md frontmatter and README.md.
  • [DATA_EXFILTRATION]: Functional data, such as product images and URLs, is sent to the official clipcat.ai API for processing.
  • Evidence: Use of -F "item_image=@/path/to/product.jpg" in POST requests to https://clipcat.ai in SKILL.md.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 5, 2026, 04:41 PM
Security Audit — agent-trust-hub — openclaw-support