IMA AI Video Generator — Short & Promo Video, Text to Video, Image to Video Generation

AI video generator with premier models: Wan 2.6, Kling O1/2.6, Google Veo 3.1, Sora 2 Pro, Pixverse V5.5, Hailuo 2.0/2.3, SeeDance 1.5 Pro, Vidu Q2. Video ge...

Security Scan

The skill's files, runtime instructions, and required credentials are consistent with a text/image-to-video generation tool that uploads user media to the provider's API; nothing in the bundle suggests covert or unrelated behavior.

Purpose & Capability

Name/description match the code and runtime contract: the skill requires a single provider API key (IMA_API_KEY), Python + ffmpeg/ffprobe, and uses requests/Pillow for network and image probing. Those requirements are proportional to a video-generation connector that uploads local media and polls remote tasks.

Instruction Scope

SKILL.md and the CLI/scripts clearly instruct the agent to accept prompts, probe remote or local media, and (for local files) obtain an upload-token then PUT bytes to a pre-signed HTTPS storage URL. This is expected for media uploads, but it means the tool will read and transmit any local files you provide. SKILL.md claims only direct public HTTPS remote media are allowed and that temp downloads are deleted; those policies appear documented in the repo, but you should review the implementation if you need strict guarantees.

Install Mechanism

No download-from-URL install is present; the repo is instruction/code-based and uses a typical requirements.txt (requests, Pillow). No installer pulls arbitrary archives or executes code from unknown hosts. Installing Python deps (pip install -r requirements.txt) is the only setup friction called out.

Credentials

Only one environment secret is required: IMA_API_KEY (declared as primary). That is appropriate for a single-provider API integration. The scripts read IMA_API_KEY (or accept --api-key) and do not request other unrelated credentials or system secrets in the visible files.

Persistence & Privilege

The skill writes preferences and logs to ~/.openclaw/memory/ima_prefs.json and ~/.openclaw/logs/ima_skills/. Log retention is documented (7 days). The skill is not marked always:true and does not modify other skills' configs. Be aware that logs may contain operational information (e.g., model choices, errors); they are stored on disk by default.

Scan Findings in Context

[pre_scan_injection] expected: No pre-scan injection or suspicious regex findings were detected. Network interactions and local-file upload behavior are expected for a media-generation skill and appear documented in the repo (api.imastudio.com and imapi.liveme.com endpoints).

Assessment

This package appears to do what it claims, but review these practical points before installing or running it: 1) The skill uploads any local files you pass to the provider (it uses an upload-token + pre-signed PUT flow). Do not pass sensitive local files—only give media you intend to upload. 2) It requires and will send IMA_API_KEY to the provider endpoints; use a scoped or test key for initial trials. 3) Logs and a small prefs file are written under ~/.openclaw/ (logs retained ~7 days). If you need absolute assurance about handling of downloaded remote media, or about rejection of redirects/credentialed URLs, inspect the networking code (shared/client.py and references/shared/security-and-network.md) before use. 4) There are minor metadata mismatches (homepage/branding variations in files), which are not directly dangerous but you may want to confirm you trust the provider domain (https://www.imaclaw.ai and api.imastudio.com) before giving the API key.

IMA Video AI

When To Use

Use this repository for text-to-video, image-to-video, reference-image video generation, and first/last-frame interpolation. This repo is video-only; do not route image editing, audio, or non-video tasks here.

Quick Start

1. Get your API key at https://www.imaclaw.ai/imaclaw/apikey, then export it: export IMA_API_KEY="your-api-key"
2. Run a low-cost health probe before spending credits: python3 scripts/ima_runtime_doctor.py --task-type text_to_video
3. First-time setup: python3 scripts/ima_runtime_setup.py
4. Manual first-run alternative if you skip setup: in an interactive terminal, python3 scripts/ima_runtime_cli.py --task-type text_to_video --prompt "..." now prompts for a suggested model; non-interactive callers should still use --model-id or --list-models
5. Natural-language wrapper: python3 scripts/route_and_execute.py --request "做一个 10 秒的产品视频" for parse + validate + execute

First-Run Rules

• Runtime model resolution is fixed: --model-id -> saved preference -> interactive TTY prompt -> fail; there is no hidden default model.
• First use can run python3 scripts/ima_runtime_setup.py, accept the first-run CLI prompt in a terminal, or choose --model-id after --list-models; setup writes only ~/.openclaw/memory/ima_prefs.json, never IMA_API_KEY.
• Install Python dependencies with pip install -r requirements.txt; Pillow is used for image-dimension probing.
• Ensure ffprobe is on PATH for video/audio metadata probing and ffmpeg is on PATH for derived video cover extraction.

Picks And Errors

• Start with ima-pro-fast for text_to_video / image_to_video; start with kling-video-o1 for reference_image_to_video / first_last_frame_to_video. Full matrix: references/shared/model-selection-policy.md
• 401 or invalid key -> regenerate at https://www.imaclaw.ai/imaclaw/apikey and rerun ima_runtime_doctor.py; 403 / 4014 -> subscribe or switch to ima-pro-fast; 6009 / 6010 -> remove custom params and confirm the live catalog with --list-models

Video Modes

• first_last_frame means explicit start/end frames with generated motion between them; reference means style or character guidance, not literal frame 1.

Gateway Contract

Treat this file as the public gateway, not the full rulebook.

• The generation entrypoint is python3 scripts/ima_runtime_cli.py ....
• python3 scripts/route_and_execute.py is the natural-language wrapper over the structured runtime.
• python3 scripts/ima_runtime_setup.py and python3 scripts/ima_runtime_doctor.py are onboarding helpers, not alternate generation runtimes.
• No other generation CLI path is part of the active runtime contract.
• Remote HTTPS reference media must be direct public URLs. The runtime may temporarily download them locally for metadata probing, Seedance preflight checks, and video-cover extraction; private/internal hosts, credentialed URLs, redirects, and oversized downloads are rejected.
• Local media files and derived video cover frames use IMA's upload-token flow and then upload to the pre-signed HTTPS storage URL returned by that service.
• Build a GatewayRequest for a video target.
• Resolve task type before execution, and clarify when image roles are ambiguous.
• Query the product list before task creation so attribute_id, model_version, and defaults come from the live catalog.
• Return video results as remote HTTPS URLs; do not convert them into local file attachments.

Read Order

references/README.md, references/gateway/entry-and-routing.md, references/gateway/workflow-confirmation.md, references/shared/model-selection-policy.md, references/shared/error-policy.md, references/shared/security-and-network.md, capabilities/video/CAPABILITY.md

Boundary

references/gateway/* covers entry/routing, references/shared/* covers shared runtime policy, capabilities/video/* owns video behavior, and _meta.json plus clawhub.json remain metadata inputs.