ClawHub

Pixcli Skill

v2.2.1

Creative toolkit for AI agents — generate images, videos, voiceover, music, and sound effects, then assemble polished output via Remotion. Uses the pixcli CL...

⭐ 0· 61·0 current·0 all-time
by@cohnen·duplicate of @cohnen/pixcli-skill
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (image/video/audio generation + Remotion templates) match what is included: a pixcli CLI workflow and multiple Remotion templates and rules. The declared requirement (PIXCLI_API_KEY) and required binaries (node or npx) are appropriate for invoking pixcli and running Remotion/npm-based templates.
ℹ
Instruction Scope
SKILL.md instructs the agent to install/use the pixcli CLI, set PIXCLI_API_KEY, run pixcli commands, copy template folders, run npm install, and use npx remotion to render. Those steps align with the stated purpose. One minor scope note: README mentions OPENROUTER_API_KEY can act as a fallback (optional) even though it is not declared as required—this is informational but could cause the CLI to prefer an alternative API key if present in the environment. No instructions ask the agent to read unrelated system files or exfiltrate data to unexpected endpoints.
✓
Install Mechanism
There is no automatic install spec in the registry (instruction-only at install time), which is lower risk. The templates include package.json files and the documentation encourages running npm install in copied template folders — that will pull standard Remotion/npm dependencies from public registries (expected for this use). No downloads from obscure URLs or extract-from-arbitrary-URL steps are present in the skill bundle itself.
ℹ
Credentials
The skill requires a single primary credential, PIXCLI_API_KEY, which is proportional to a hosted CLI/API service. The README's mention that OPENROUTER_API_KEY "works as a fallback" is not reflected in requires.env — it's optional but worth noting because an agent or user environment containing that key could be used by the CLI implicitly. No other credentials or broad system config paths are requested.
✓
Persistence & Privilege
The skill does not request always:true and contains no installation that would force persistent system-wide privileges. Autonomous agent invocation is allowed by default (disable-model-invocation is false) — expected for skills. Be aware: if you supply PIXCLI_API_KEY as an environment variable, the skill (when invoked) can use that key to call the external pixcli service.
Assessment
This skill appears coherent and implements a CLI + Remotion template workflow. Before installing or using it: 1) Only provide a PIXCLI_API_KEY you trust and monitor billing/usage on that account; the CLI sends prompts and assets to pixcli.shellbot.sh (or an overridden --api-url). 2) If you have other API keys in your environment (e.g., OPENROUTER_API_KEY), consider unsetting them if you do not want the CLI to use them as a fallback. 3) Running the recommended template steps (npm install, npx remotion render) will download standard npm packages; run those commands in a sandboxed/project folder you control, not a sensitive system directory. 4) If you plan to allow autonomous agent invocation, remember the agent could call the external API using whatever API key you provide — use least-privilege keys and monitor requests. If you want, I can list the exact files that would be written when following the README bootstrap steps and the npm dependencies they pull so you can audit them further.

Like a lobster shell, security has layers — review code before you run it.

latestvk971vczjvrbnzkzevzcx0zh0v1840jck

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎨 Clawdis
Any binnode, npx
EnvPIXCLI_API_KEY
Primary envPIXCLI_API_KEY

Comments