registry / videoclaw / 3.0.0-alpha.3

videoclaw@3.0.0-alpha.3

Agent-friendly multi-provider AI video CLI (Veo, Seedance, Runway, Omni Flash) with on-disk JSON artifacts, approval gates, storyboard review UI, and portfolio ops. v3 — narrow, deterministic, agent-target CLI.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 556 file(s), 5.13 MB of source, external domains: api.apiz.ai, api.elevenlabs.io, api.kie.ai, api.magnific.com, api.openai.com, api.useapi.net, api.xskill.ai, fonts.googleapis.com, fonts.gstatic.com, generativelanguage.googleapis.com, gobananasai.com, httpbin.org, kie.ai, metadata.google.internal, uguu.se, useapi.net, www.w3.org, www.xskill.ai

Source & flagged code

2 flagged

dist/video/audio-platform/native-lyria.jsView file

Lines 1-27javascript

1/**

2 * Music generation via Google Vertex AI Lyria (predict endpoint).

3 *

4 * VERIFIED LIVE against `lyria-002` (Lyria 2, GA) on 2026-06-01 — the request

5 * body and response field below match the real API. INERT / unavailable

6 * without a Vertex project (GOOGLE_CLOUD_PROJECT or VERTEX_PROJECT must be set).

7 *

8 * POST https://{REGION}-aiplatform.googleapis.com/v1/projects/{PROJECT}/

9 * locations/{REGION}/publishers/google/models/{MODEL}:predict

10 * Authorization: Bearer <token>

11 * Body: { instances: [{ prompt: string }], parameters: { sampleCount: 1 } }

12 * Response: { predictions: [{ bytesBase64Encoded: string (WAV), mimeType }] }

13 *

14 * MODEL (via LYRIA_MODEL env, default lyria-002):

15 * - lyria-002 Lyria 2, GA, 30s, text-only ($0.06/30s)

16 * - lyria-3-clip-preview Lyria 3, 30s, text+image (PREVIEW — needs project allowlist)

17 * - lyria-3-pro-preview Lyria 3 Pro, ~184s full song, text+image (PREVIEW — allowlist)

18 * NOTE: the Lyria 3 image-input (multimodal) request shape is NOT yet wired or

19 * verified here — it needs preview allowlist access; add + verify once granted.

20 *

21 * Auth (tried in order): GOOGLE_ACCESS_TOKEN env -> GCE metadata server ->

22 * `gcloud auth print-access-token` (local dev, dependency-free). For prod/CI,

23 * set GOOGLE_ACCESS_TOKEN or run on a GCE/Cloud Run service account.

24 * requiresVertex: true.

25 */

26import { mkdir, writeFile } from 'node:fs/promises';

27import { dirname } from 'node:path';

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/video/audio-platform/native-lyria.jsView on unpkg · L7

dist/video/review-ui.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = videoclaw@3.0.0-alpha.4 matchedIdentity = npm:dmlkZW9jbGF3:3.0.0-alpha.4 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/video/review-ui.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/video/audio-platform/native-lyria.jsView file

7* L8: * POST https://{REGION}-aiplatform.googleapis.com/v1/projects/{PROJECT}/ L9: * locations/{REGION}/publishers/google/models/{MODEL}:predict L10: * Authorization: Bearer <token> L11: * Body: { instances: [{ prompt: string }], parameters: { sampleCount: 1 } } L12: * Response: { predictions: [{ bytesBase64Encoded: string (WAV), mimeType }] } L13: * ... L27: import { dirname } from 'node:path'; L28: import { execFile } from 'node:child_process'; L29: import { promisify } from 'node:util'; ... L86: try { L87: const metaResp = await fetcher('http://metadata.google.[redacted]-accounts/default/token', { headers: { 'Metadata-Flavor': 'Google' } });

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/video/audio-platform/native-lyria.jsView on unpkg · L7

dist/video/review-ui.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/video/review-ui.jsView on unpkg

Findings

2 High3 Medium6 Low

HighCloud Metadata Accessdist/video/audio-platform/native-lyria.js

HighPrevious Version Dangerous Deltadist/video/review-ui.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/video/audio-platform/native-lyria.jsView file

Lines 1-27javascript

1/**

2 * Music generation via Google Vertex AI Lyria (predict endpoint).

3 *

4 * VERIFIED LIVE against `lyria-002` (Lyria 2, GA) on 2026-06-01 — the request

5 * body and response field below match the real API. INERT / unavailable

6 * without a Vertex project (GOOGLE_CLOUD_PROJECT or VERTEX_PROJECT must be set).

7 *

8 * POST https://{REGION}-aiplatform.googleapis.com/v1/projects/{PROJECT}/

9 * locations/{REGION}/publishers/google/models/{MODEL}:predict

10 * Authorization: Bearer <token>

11 * Body: { instances: [{ prompt: string }], parameters: { sampleCount: 1 } }

12 * Response: { predictions: [{ bytesBase64Encoded: string (WAV), mimeType }] }

13 *

14 * MODEL (via LYRIA_MODEL env, default lyria-002):

15 * - lyria-002 Lyria 2, GA, 30s, text-only ($0.06/30s)

16 * - lyria-3-clip-preview Lyria 3, 30s, text+image (PREVIEW — needs project allowlist)

17 * - lyria-3-pro-preview Lyria 3 Pro, ~184s full song, text+image (PREVIEW — allowlist)

18 * NOTE: the Lyria 3 image-input (multimodal) request shape is NOT yet wired or

19 * verified here — it needs preview allowlist access; add + verify once granted.

20 *

21 * Auth (tried in order): GOOGLE_ACCESS_TOKEN env -> GCE metadata server ->

22 * `gcloud auth print-access-token` (local dev, dependency-free). For prod/CI,

23 * set GOOGLE_ACCESS_TOKEN or run on a GCE/Cloud Run service account.

24 * requiresVertex: true.

25 */

26import { mkdir, writeFile } from 'node:fs/promises';

27import { dirname } from 'node:path';

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/video/audio-platform/native-lyria.jsView on unpkg · L7

dist/video/review-ui.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/video/review-ui.jsView on unpkg