Kling
v1.0.0Generate 5-second AI videos in 16:9 ratio using Kling 2.6 for fitness promos, UGC marketing, testimonials, and product demos.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The JS code and SKILL.md consistently implement a text-to-video client for Kie.ai (endpoints: /jobs/createTask, /jobs/recordInfo, /user/credits). Requiring a KIE_API_KEY is coherent with that purpose. However, the registry metadata lists no required environment variables or primary credential, which is inconsistent with the code and SKILL.md.
Instruction Scope
Runtime instructions are narrowly scoped to generating videos, checking status, and checking credits. They reference running the included CLI and storing an API key in a .env file, but do not instruct reading unrelated system files or exfiltrating data to unexpected endpoints. All network calls go to api.kie.ai.
Install Mechanism
This is an instruction-only skill with no install spec. The package files include a simple dependency (axios). There is no downloadable installer or external URL; no archive extraction or unusual install behavior is present.
Credentials
The code requires KIE_API_KEY (process.env.KIE_API_KEY) and SKILL.md explicitly mentions storing the API key in .env, but the registry metadata declares no required env vars or primary credential. The skill does not include dotenv or logic to auto-load a .env file, which is a documentation/runtime mismatch. Requiring a single API key for the remote video service is proportionate, but the missing declaration is a notable inconsistency.
Persistence & Privilege
The skill does not request permanent/all-agent presence (always: false) and does not modify other skills or system configs. It has normal, limited privileges.
What to consider before installing
This skill appears to do what it claims (a Kie.ai text-to-video client). Before installing: 1) Be aware the code requires an API key named KIE_API_KEY — the registry metadata omitted this, so you must supply it to use the skill. 2) Prefer storing the key in a secure agent secret store rather than a plaintext .env file; the package does not include dotenv so the .env mention is only instructional. 3) Verify you trust the Kie.ai endpoint and the skill owner before providing credentials. 4) Review the code if you need guarantees (it only calls api.kie.ai endpoints). 5) If you deploy this in a multi-tenant environment, restrict the API key's permissions and monitor usage. If you need the metadata corrected (so the platform can surface required credentials), ask the publisher to declare KIE_API_KEY as the primary credential.Like a lobster shell, security has layers — review code before you run it.
latest
Kling Video Generation Skill
Generate AI videos using Kling 2.6 (via Kie.ai).
Commands
# Generate video and wait for result
/root/clawd/skills/kling/kling.js generate "A gym owner high-fiving a member"
# Quick start (returns task ID immediately)
/root/clawd/skills/kling/kling.js quick "Professional fitness environment"
# Check status
/root/clawd/skills/kling/kling.js status <task_id>
Parameters
- Model: kling-2.6/text-to-video (default)
- Aspect Ratio: 16:9 (default)
- Duration: 5 seconds (default)
- Negative Prompt: Filters out blurry/low quality
Use Cases
- UGC-style marketing videos
- Gym/fitness promotional content
- LinkedIn video posts
- Client testimonial visualizations
- Product demos
Notes
- Videos take 1-5 minutes to generate
- Results include video URL in the response
- API key stored in
.envasKIE_API_KEY
Comments
Loading comments...
