Scan Report
0 /100
video-resizer
OpenClaw skill for Sparki AI video editing - aspect-ratio and platform-format conversion
Legitimate video editing CLI tool with clean codebase, well-documented behavior, and no security issues detected.
Safe to install
This skill is safe to use. No action required.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | READ | READ | ✓ Aligned | cli.py:178 - opens user-provided video files for upload |
| Filesystem | WRITE | WRITE | ✓ Aligned | client.py:108 - streams downloads to output_path; config.py:44 - writes config t… |
| Network | READ | READ | ✓ Aligned | client.py - all HTTP calls use httpx to agent-api.sparki.io only |
| Shell | NONE | NONE | — | No subprocess, os.system, or shell execution found |
| Environment | NONE | READ | ✓ Aligned | config.py:20 - reads SPARKI_API_KEY env var (legitimate, documented in _meta.jso… |
7 findings
Medium External URL 外部 URL
https://img.shields.io/badge/ClawHub-Skill-blueviolet README.md:3 Medium External URL 外部 URL
https://clawhub.io README.md:3 Medium External URL 外部 URL
https://img.shields.io/badge/version-1.0.12-blue README.md:4 Medium External URL 外部 URL
https://sparki.io SKILL.md:17 Medium External URL 外部 URL
https://agent-api.sparki.io src/sparki_cli/constants.py:61 Medium External URL 外部 URL
https://t.me/Sparki_AI_bot/upload src/sparki_cli/constants.py:62 Medium External URL 外部 URL
https://sparki.io/pricing src/sparki_cli/constants.py:101 File Tree
11 files · 33.3 KB · 1010 lines Python 7f · 904L
Markdown 2f · 71L
TOML 1f · 31L
JSON 1f · 4L
├─
▾
src
│ └─
▾
sparki_cli
│ ├─
__init__.py
Python
│ ├─
cli.py
Python
│ ├─
client.py
Python
│ ├─
config.py
Python
│ ├─
constants.py
Python
│ ├─
models.py
Python
│ └─
output.py
Python
├─
_meta.json
JSON
├─
pyproject.toml
TOML
├─
README.md
Markdown
└─
SKILL.md
Markdown
Dependencies 3 items
| Package | Version | Source | Known Vulns | Notes |
|---|---|---|---|---|
typer | >=0.9.0 | pip | No | Legitimate CLI framework |
httpx | >=0.27.0 | pip | No | Legitimate HTTP client |
pydantic | >=2.0.0 | pip | No | Legitimate data validation library |
Security Positives
✓ No subprocess, shell execution, or command injection vectors
✓ No base64 encoding/decoding or code obfuscation
✓ No credential exfiltration - API key is stored locally, not transmitted elsewhere
✓ No access to sensitive paths (~/.ssh, ~/.aws, .env files)
✓ No remote script execution (curl|bash, wget|sh)
✓ No eval(), exec(), or dynamic code execution
✓ No hidden functionality - all operations are visible in CLI commands
✓ Dependencies (typer, httpx, pydantic) are reputable and well-known
✓ Network communication restricted to declared domain (agent-api.sparki.io)
✓ Filesystem access limited to declared paths (CWD for reads, openclaw config dirs for writes)
✓ API key read from environment variable is standard, documented behavior