melies Security Report — Trusted | ClawSafe

5 /100

melies

AI filmmaking CLI with 148 built-in actors, 98 visual styles, and smart model selection. Generate images, videos, posters, and thumbnails without prompt engineering.

A legitimate AI filmmaking CLI tool with no malicious behavior detected. All functionality is documented, network calls go to declared melies.co endpoints, and the only shell execution (browser-opening) is documented and necessary.

Skill Namemelies

Duration69.0s

Enginepi

✓

Safe to install

This skill is safe to use. No security concerns identified.

Findings 2 items

Severity	Finding	Location
Info	Token storage in ~/.melies/config.json Sensitive Access The skill stores the user's API token in a config file. This is standard practice for CLI tools and is declared in SKILL.md metadata. `const CONFIG_DIR = path.join(os.homedir(), '.melies')` → No action needed - behavior is documented and necessary for authentication.	`src/config.ts:9`
Info	yargs dependency uses caret version range Supply Chain package.json specifies yargs as ^17.7.2, allowing minor/patch updates. This introduces minor version drift risk. `"yargs": "^17.7.2"` → Consider pinning exact versions (17.7.2) for production deployments if strict dependency control is required.	`package.json:40`

Resource	Declared	Inferred	Status	Evidence
Filesystem	`WRITE`	`WRITE`	✓ Aligned	Writes to ~/.melies/config.json (token) and user-specified output paths
Network	`READ`	`READ+WRITE`	✓ Aligned	Makes authenticated API calls to melies.co/api and fetches asset URLs from asset…
Shell	`WRITE`	`WRITE`	✓ Aligned	login.ts:14 uses exec() to open browser for OAuth, platform: open/start/xdg-open
Environment	`READ`	`READ`	✓ Aligned	Reads only MELIES_TOKEN and MELIES_API_URL - both declared in SKILL.md
Skill Invoke	`NONE`	`NONE`	—	No skill invocation capabilities
Clipboard	`NONE`	`NONE`	—	No clipboard access
Browser	`NONE`	`NONE`	—	No browser control, only URL-opening via exec
Database	`NONE`	`NONE`	—	No database access

158 findings

🔗

Medium External URL 外部 URL

https://melies.co

README.md:15

🔗

Medium External URL 外部 URL

https://melies.co/agent

README.md:177

🔗

Medium External URL 外部 URL

https://melies.co/docs

README.md:178

🔗

Medium External URL 外部 URL

https://agentskill.sh/@melies-co/melies-cli

README.md:179

🔗

Medium External URL 外部 URL

https://clawhub.ai/romainsimon/melies

README.md:180

🔗

Medium External URL 外部 URL

https://melies.co/api

SKILL.md:372

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/aria-full.webp

dist/index.js:369

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/zara-full.webp

dist/index.js:385

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/leo-full.webp

dist/index.js:401

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/mei-full.webp

dist/index.js:417

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/james-full.webp

dist/index.js:433

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/sofia-full.webp

dist/index.js:449

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/kai-full.webp

dist/index.js:465

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/riku-full.webp

dist/index.js:481

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/amara-full.webp

dist/index.js:497

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/viktor-full.webp

dist/index.js:513

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/luna-full.webp

dist/index.js:529

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/chen-full.webp

dist/index.js:545

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/yuki-full.webp

dist/index.js:561

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/elena-full.webp

dist/index.js:577

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/priya-full.webp

dist/index.js:593

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/fatimah-full.webp

dist/index.js:609

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/ingrid-full.webp

dist/index.js:625

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/yara-full.webp

dist/index.js:641

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/claire-full.webp

dist/index.js:657

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/marta-full.webp

dist/index.js:673

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/amira-full.webp

dist/index.js:689

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/adaeze-full.webp

dist/index.js:705

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/hana-full.webp

dist/index.js:721

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/vera-full.webp

dist/index.js:737

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/meiying-full.webp

dist/index.js:753

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/cleo-full.webp

dist/index.js:769

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/roshni-full.webp

dist/index.js:785

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/agnes-full.webp

dist/index.js:801

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/irem-full.webp

dist/index.js:817

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/mai-full.webp

dist/index.js:833

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/lucia-full.webp

dist/index.js:849

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/adesuwa-full.webp

dist/index.js:865

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/chiamaka-full.webp

dist/index.js:881

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/yolanda-full.webp

dist/index.js:897

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/astrid-full.webp

dist/index.js:913

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/pilar-full.webp

dist/index.js:929

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/soyeon-full.webp

dist/index.js:945

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/adela-full.webp

dist/index.js:961

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/deepa-full.webp

dist/index.js:977

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/gabriella-full.webp

dist/index.js:993

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/camille-full.webp

dist/index.js:1009

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/nour-full.webp

dist/index.js:1025

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/layla-full.webp

dist/index.js:1041

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/zainab-full.webp

dist/index.js:1057

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/keiko-full.webp

dist/index.js:1073

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/salma-full.webp

dist/index.js:1089

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/paloma-full.webp

dist/index.js:1105

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/marcus-full.webp

dist/index.js:1121

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/tomas-full.webp

dist/index.js:1137

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/finn-full.webp

dist/index.js:1153

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/kofi-full.webp

dist/index.js:1169

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/carlos-full.webp

dist/index.js:1185

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/bjorn-full.webp

dist/index.js:1201

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/sanjay-full.webp

dist/index.js:1217

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/derek-full.webp

dist/index.js:1233

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/andrei-full.webp

dist/index.js:1249

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/ibrahim-full.webp

dist/index.js:1265

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/kwame-full.webp

dist/index.js:1281

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/oliver-full.webp

dist/index.js:1297

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/paulo-full.webp

dist/index.js:1313

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/jerome-full.webp

dist/index.js:1329

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/rob-full.webp

dist/index.js:1345

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/dayo-full.webp

dist/index.js:1361

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/alejandro-full.webp

dist/index.js:1377

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/tobias-full.webp

dist/index.js:1393

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/hiro-full.webp

dist/index.js:1409

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/felix-full.webp

dist/index.js:1425

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/miguel-full.webp

dist/index.js:1441

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/pierre-full.webp

dist/index.js:1457

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/yusuf-full.webp

dist/index.js:1473

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/dante-full.webp

dist/index.js:1489

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/samuel-full.webp

dist/index.js:1505

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/lars-full.webp

dist/index.js:1521

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/winston-full.webp

dist/index.js:1537

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/tariq-full.webp

dist/index.js:1553

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/kwabena-full.webp

dist/index.js:1569

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/matteo-full.webp

dist/index.js:1585

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/ben-full.webp

dist/index.js:1601

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/kolade-full.webp

dist/index.js:1617

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/rafael-full.webp

dist/index.js:1633

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/henrik-full.webp

dist/index.js:1649

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/babatunde-full.webp

dist/index.js:1665

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/ezra-full.webp

dist/index.js:1681

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/peter-full.webp

dist/index.js:1697

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/terrence-full.webp

dist/index.js:1713

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/nikolai-full.webp

dist/index.js:1729

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/jamie-full.webp

dist/index.js:1745

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/taylor-full.webp

dist/index.js:1761

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/river-full.webp

dist/index.js:1777

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/alex-full.webp

dist/index.js:1793

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/sam-full.webp

dist/index.js:1809

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/morgan-full.webp

dist/index.js:1825

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/kendall-full.webp

dist/index.js:1841

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/reese-full.webp

dist/index.js:1857

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/quinn-full.webp

dist/index.js:1873

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/blake-full.webp

dist/index.js:1889

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/drew-full.webp

dist/index.js:1905

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/ingenue-full.webp

dist/index.js:1921

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/ming-full.webp

dist/index.js:1937

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/rodrigo-full.webp

dist/index.js:1953

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/jake-full.webp

dist/index.js:1969

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/ethan-full.webp

dist/index.js:1986

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/noah-t-full.webp

dist/index.js:2002

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/bella-full.webp

dist/index.js:2018

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/chloe-full.webp

dist/index.js:2035

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/kenzo-full.webp

dist/index.js:2051

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/sophie-full.webp

dist/index.js:2067

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/ryan-full.webp

dist/index.js:2084

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/fiona-full.webp

dist/index.js:2101

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/declan-full.webp

dist/index.js:2118

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/thor-full.webp

dist/index.js:2134

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/mason-full.webp

dist/index.js:2151

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/zoe-full.webp

dist/index.js:2167

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/chad-full.webp

dist/index.js:2184

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/cole-full.webp

dist/index.js:2200

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/raven-full.webp

dist/index.js:2217

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/brock-full.webp

dist/index.js:2234

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/meadow-full.webp

dist/index.js:2251

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/nova-full.webp

dist/index.js:2267

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/richard-full.webp

dist/index.js:2284

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/sasha-full.webp

dist/index.js:2301

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/mila-full.webp

dist/index.js:2318

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/jade-full.webp

dist/index.js:2334

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/kira-full.webp

dist/index.js:2351

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/noa-full.webp

dist/index.js:2368

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/lexi-full.webp

dist/index.js:2384

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/valentina-full.webp

dist/index.js:2401

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/hailey-full.webp

dist/index.js:2418

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/yuna-full.webp

dist/index.js:2435

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/tessa-full.webp

dist/index.js:2451

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/axel-full.webp

dist/index.js:2468

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/marco-full.webp

dist/index.js:2484

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/jayden-full.webp

dist/index.js:2500

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/theo-full.webp

dist/index.js:2517

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/dae-full.webp

dist/index.js:2533

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/titan-full.webp

dist/index.js:2549

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/serena-full.webp

dist/index.js:2566

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/gus-full.webp

dist/index.js:2583

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/rosie-full.webp

dist/index.js:2599

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/amani-full.webp

dist/index.js:2615

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/edith-full.webp

dist/index.js:2631

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/tommy-full.webp

dist/index.js:2646

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/nia-full.webp

dist/index.js:2662

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/sage-full.webp

dist/index.js:2678

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/rex-full.webp

dist/index.js:2695

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/sienna-full.webp

dist/index.js:2712

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/lola-full.webp

dist/index.js:2729

🔗

Medium External URL 外部 URL

https://asset.melies.co/actors/mika-full.webp

dist/index.js:2746

🔗

Medium External URL 外部 URL

https://melies.co\nDiscover

dist/index.js:4082

🔗

Medium External URL 外部 URL

https://agentskill.sh

dist/index.js:4082

🔗

Medium External URL 外部 URL

https://melies.co\n

src/index.ts:41

📧

Info Email 邮箱地址

[email protected]

package.json:35

File Tree

32 files · 298.9 KB · 10126 lines

JavaScript 1f · 4083L JSON 5f · 3225L TypeScript 24f · 2243L Markdown 2f · 575L

├─ ▾ 📁 dist

│ └─ 📜 index.js JavaScript 4083L · 119.8 KB

├─ ▾ 📁 src

│ ├─ ▾ 📁 commands

│ │ ├─ 📜 actors.ts TypeScript 76L · 2.1 KB

│ │ ├─ 📜 assets.ts TypeScript 62L · 1.6 KB

│ │ ├─ 📜 credits.ts TypeScript 42L · 1.1 KB

│ │ ├─ 📜 image.ts TypeScript 233L · 7.2 KB

│ │ ├─ 📜 login.ts TypeScript 112L · 3.6 KB

│ │ ├─ 📜 models.ts TypeScript 42L · 1.1 KB

│ │ ├─ 📜 pipeline.ts TypeScript 199L · 6.6 KB

│ │ ├─ 📜 poster.ts TypeScript 201L · 6.7 KB

│ │ ├─ 📜 ref.ts TypeScript 121L · 3.2 KB

│ │ ├─ 📜 remove-bg.ts TypeScript 77L · 2.2 KB

│ │ ├─ 📜 status.ts TypeScript 46L · 1.3 KB

│ │ ├─ 📜 styles.ts TypeScript 83L · 2.3 KB

│ │ ├─ 📜 thumbnail.ts TypeScript 157L · 5.0 KB

│ │ ├─ 📜 upscale.ts TypeScript 104L · 3.0 KB

│ │ └─ 📜 video.ts TypeScript 179L · 5.8 KB

│ ├─ ▾ 📁 data

│ │ ├─ 📋 actors.json JSON 2396L · 63.0 KB

│ │ ├─ 📋 poster-styles.json JSON 142L · 5.9 KB

│ │ └─ 📋 variation-presets.json JSON 611L · 23.9 KB

│ ├─ ▾ 📁 utils

│ │ ├─ 📜 actors.ts TypeScript 55L · 1.5 KB

│ │ ├─ 📜 download.ts TypeScript 30L · 939 B

│ │ ├─ 📜 model-resolver.ts TypeScript 49L · 1.4 KB

│ │ ├─ 📜 prompt-builder.ts TypeScript 16L · 327 B

│ │ └─ 📜 style-options.ts TypeScript 68L · 3.2 KB

│ ├─ 📜 api.ts TypeScript 176L · 4.6 KB

│ ├─ 📜 config.ts TypeScript 59L · 1.6 KB

│ └─ 📜 index.ts TypeScript 44L · 1.6 KB

├─ 📋 package.json JSON 57L · 1.1 KB

├─ 📝 README.md Markdown 180L · 5.0 KB

├─ 📝 SKILL.md Markdown 395L · 11.9 KB

├─ 📋 tsconfig.json JSON 19L · 445 B

└─ 📜 tsup.config.ts TypeScript 12L · 215 B

Dependencies 5 items

Package	Version	Source	Known Vulns	Notes
`yargs`	`^17.7.2`	npm	No	Caret range allows minor updates
`@types/node`	`^20.11.19`	npm	No	Dev dependency
`@types/yargs`	`^17.0.32`	npm	No	Dev dependency
`tsup`	`^8.5.1`	npm	No	Dev dependency, build tool
`typescript`	`^5.3.3`	npm	No	Dev dependency

Security Positives

✓ No eval(), atob(), btoa(), or code obfuscation patterns found

✓ No credential harvesting beyond the service's own declared API token

✓ No access to sensitive paths (~/.ssh, ~/.aws, .env)

✓ No curl|bash or wget|sh remote script execution

✓ No hidden instructions in HTML comments or data files

✓ No base64-encoded execution or anti-analysis techniques

✓ All network requests go to the declared melies.co service

✓ No reverse shell, C2, or data exfiltration patterns

✓ Shell exec() is limited to browser URL-opening for OAuth - documented and necessary

✓ Comprehensive SKILL.md documentation fully matches implementation

✓ No malicious dependencies detected in package.json

Scan Report

Findings 2 items

File Tree

Dependencies 5 items

Security Positives