v1.0.6

IMA AI Video Generator — Short & Promo Video, Text to Video, Image to Video Generation

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:27 AM.

Analysis

The skill appears purpose-aligned for cloud video generation, but users should notice that it sends prompts/images and the IMA API key to provider endpoints, stores local logs/preferences, and includes a scoped log-deletion command.

GuidanceBefore installing, make sure you trust IMA Studio with your API key, prompts, and any images you upload for generation. Use non-sensitive media, keep your API key scoped and rotatable, and review the local ~/.openclaw memory/log files if you care about retaining generation history.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL-DETAIL.md

- ✅ **Delete logs**: `rm -rf ~/.openclaw/logs/ima_skills/`

The documentation includes a destructive shell command to remove the skill's log directory. It is scoped to the skill's logs and not shown as automatically executed.

User impactRunning the command would permanently delete this skill's local logs.

RecommendationRun the deletion command only if you intentionally want to remove those logs, and consider using a safer interactive delete command.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

requirements.txt

requests>=2.25.0

The skill depends on the standard Python requests package using a lower-bound version range rather than an exact pinned version.

User impactIf dependencies are installed, the exact requests version may vary by environment.

RecommendationInstall dependencies from a trusted package source, preferably in a controlled environment with reviewed or pinned package versions.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityMediumConfidenceHighStatusNote

scripts/ima_video_create.py

DEFAULT_BASE_URL = "https://api.imastudio.com" ... DEFAULT_IM_BASE_URL = "https://imapi.liveme.com" ... "appUid": api_key ... "cmimToken": api_key

The primary IMA API key is used for both the main video API and the image-upload service. This is disclosed and purpose-aligned, but it expands where the credential is sent.

User impactYour IMA API key is required and is transmitted to IMA's main API and its upload service when generating videos with local images.

RecommendationUse an IMA API key with the least privilege available, rotate it if exposed, and install only if you are comfortable with both listed endpoints receiving it.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityMediumConfidenceHighStatusNote

SKILL-DETAIL.md

Image files are uploaded to `imapi.liveme.com` to obtain CDN URLs (for image_to_video, first_last_frame_to_video, reference_image_to_video tasks)

Image-based video generation sends user-provided image files to a remote upload/CDN service before video generation.

User impactPhotos or images used for image-to-video modes will be uploaded to the provider's infrastructure.

RecommendationAvoid using private, sensitive, or confidential images unless you accept the provider's handling of uploaded media.

Memory and Context Poisoning

SeverityLowConfidenceHighStatusNote

SKILL.md

persistence:\n  readWrite:\n    - ~/.openclaw/memory/ima_prefs.json\n    - ~/.openclaw/logs/ima_skills/

The skill stores preferences and logs persistently in the user's OpenClaw directory.

User impactModel preferences and operational logs may remain on disk after video generation.

RecommendationReview or delete the skill's log and preference files if you do not want this local history retained.