WaveSpeedAI Wan 2.6 Video Generation

Generate videos using Alibaba's Wan 2.6 model via WaveSpeed AI. Supports text-to-video and image-to-video generation with up to 15 seconds duration at 720p o...

This skill appears to do what its description says (video generation via WaveSpeed AI), but there are two issues to consider before installing: - Manifest mismatch: The SKILL.md expects a WAVESPEED_API_KEY, yet the registry metadata lists no required environment variables or primary credential. Ask the publisher to update the manifest so you know what secrets are needed. - Local-file uploads: Examples show uploading local files (e.g., wavespeed.upload('/path/to/photo.png')). If you let the agent run autonomously, it could read and upload local files you point it to. Avoid giving it access to sensitive files and only upload content you are comfortable sharing with the external service. - Origin unknown: There's no homepage and the source is unknown. Prefer skills from known authors or that include a homepage/repo so you can verify endpoints and client libraries. - Operational advice: If you proceed, use a scoped API key with minimal privileges, avoid using secrets used elsewhere, and review any files you plan to upload. Request the author to (1) add WAVESPEED_API_KEY to the declared required env vars, (2) provide a homepage/repo link, and (3) clarify any data-retention or privacy policies for uploaded media.

Type: OpenClaw Skill Name: wavespeed-wan-26 Version: 1.0.0 The skill is classified as suspicious due to the presence of high-risk capabilities that could be exploited via prompt injection, despite the inclusion of security warnings. Specifically, the `wavespeed.upload()` function demonstrated in `SKILL.md` allows the agent to upload local files, which could be abused to exfiltrate sensitive data (e.g., `/etc/passwd`, `~/.ssh/id_rsa`) if a malicious prompt instructs the agent to upload arbitrary file paths. Additionally, the `image` and `audio` parameters accept external URLs, introducing a potential Server-Side Request Forgery (SSRF) vulnerability if the agent is prompted to fetch untrusted or internal network resources.