ClawHub

Dream Face

v1.0.0

Drop a photo or video and describe the face you've always imagined — Dream Face brings it to life. This skill uses advanced AI to generate, transform, and vi...

⭐ 0· 40·0 current·0 all-time
by@bwbernardweston18
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The skill's name/description (face/portrait generation) matches the declared requirement (NEMO_TOKEN) and the documented API endpoints for image/video upload, SSE generation, credits, and session management. No unrelated credentials, binaries, or system services are requested.
ℹ
Instruction Scope
Instructions stay within the service scope (check/set token, create/read a small ~/.config/dream-face/client_id, create a session, upload media, poll status/use SSE). Two points to note: (1) the skill uploads user photos/videos to a third-party API (sensitive personal data), and (2) the SKILL.md is vague about exactly where the obtained anonymous token should be stored if NEMO_TOKEN is not already set (it implies the runtime will set/use it). Both are expected for a cloud-based image generator but are privacy-sensitive.
✓
Install Mechanism
This is an instruction-only skill with no install spec and no code files; that is the lowest install risk. Nothing is downloaded or written beyond the small client_id file the skill asks to create.
✓
Credentials
Only a single service credential (NEMO_TOKEN) is required and declared as the primary credential, which is proportionate for a cloud inference service. There are no unrelated required env vars. The only config path used is a service-specific client_id file in the user's home config directory.
✓
Persistence & Privilege
The skill does persist a small client_id file and stores a session_id/token for use with the backend — reasonable for an API-backed skill. 'always' is false and the skill does not request system-wide or other-skills' configuration changes.
Assessment
This skill appears to do what it claims, but consider privacy and token handling before installing: the skill will upload any photos or videos you give it to mega-api-prod.nemovideo.ai — only upload images you have the right to share. The skill will write a small ~/.config/dream-face/client_id file and will obtain/store a short-lived NEMO_TOKEN if one isn't provided; ask how/where that token is persisted if you want it kept out of long-term storage. Verify the backend domain and review its privacy/retention policy if you care about sensitive biometric data. If you prefer more control, set NEMO_TOKEN yourself (instead of letting the skill fetch/store one) or avoid uploading real personal photos.

Like a lobster shell, security has layers — review code before you run it.

latestvk97dbnhkepz3b39dsn18f1n95n840tq6

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🌙 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments