Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

runninghub-video

v1.0.0

Use RunningHub official standard-model APIs for image-to-video generation. Trigger when the user asks to use RunningHub, 可灵, Seedance, 万相, or other RunningHu...

0· 20·0 current·0 all-time
bybalckbeeai@darker314159

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for darker314159/runninghub-video.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "runninghub-video" (darker314159/runninghub-video) from ClawHub.
Skill page: https://clawhub.ai/darker314159/runninghub-video
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install runninghub-video

ClawHub CLI

Package manager switcher

npx clawhub@latest install runninghub-video
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill's name, SKILL.md, API reference, and script all align with the stated purpose (submit image-to-video jobs, poll /openapi/v2/query, upload local files, download outputs). However the declared registry metadata lists no required environment variables or primary credential while the included script clearly requires an API key (RUNNINGHUB_API_KEY or --api-key). This metadata omission is an inconsistency.
Instruction Scope
The SKILL.md instructs the agent to use the included script to upload local files, poll tasks, and download outputs — this matches the script. The script uploads local files to https://www.runninghub.cn and downloads returned media. One behavior not called out explicitly in SKILL.md: the script, when not given a CLI key, will attempt to read RUNNINGHUB_API_KEY from the user environment and on Windows will try to read HKCU\Environment via winreg.
Install Mechanism
No install spec (instruction-only with a helper script). Nothing is downloaded during install and no external install URLs are present. Risk surface comes from running the included script, not from a remote installer.
!
Credentials
The script requires an API key to call RunningHub (accepted via --api-key or RUNNINGHUB_API_KEY). The skill metadata did not declare this required environment variable. The script also probes the Windows registry for the same key, which is unusual and should be documented/justified. No other unrelated credentials are requested.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and does not persist credentials itself. It runs as an on-demand helper script and behaves as a normal, non-persistent skill.
What to consider before installing
This skill will upload any local images you give it to https://www.runninghub.cn and will attempt to use an API key. Before installing or running it: (1) Be aware you must provide a RunningHub API key (via --api-key or the RUNNINGHUB_API_KEY environment variable); the skill metadata incorrectly omits this. (2) Inspect the script yourself — it reads local files and (on Windows) will try to read HKCU\Environment for RUNNINGHUB_API_KEY. (3) If you do not want your API key or files transmitted, do not run the script; consider running it in an isolated environment or supplying the key on the CLI for more control. (4) If you plan to install the skill for others, request the author fix the metadata to declare the required env var and document the registry access. (5) If you need more assurance, ask the publisher for an authoritative homepage or source repository to verify origin and review the remainder of the code (the provided script was truncated in the manifest listing — verify the complete file before use).

Like a lobster shell, security has layers — review code before you run it.

latestvk97dms9tbf14f93ch0armrymg585mqkw
20downloads
0stars
1versions
Updated 6h ago
v1.0.0
MIT-0

RunningHub Video

Use this skill to submit image-to-video jobs to RunningHub, poll task status, and download the finished video locally.

Quick Start

  1. Confirm the user wants RunningHub image-to-video rather than HTML/CSS animation or local FFmpeg edits.
  2. Use scripts/runninghub_video.py instead of hand-writing curl unless the user explicitly asks for raw API calls.
  3. Accept either:
    • a public image URL
    • a local image path that should be uploaded through RunningHub's binary upload endpoint first
  4. Wait for /openapi/v2/query unless the user explicitly asks for submit-only behavior.
  5. Download the returned media immediately because RunningHub-hosted outputs and uploaded media links can expire.

Default Workflow

1. Pick the model

Use these stable shortcuts unless the user names a different endpoint:

  • wan-2.2: default choice for general image-to-video generation in this skill
  • kling-v3.0-std: strong alternative for high-quality single-image or start/end-frame generation
  • seedance-2.0-global: quality-oriented alternative with resolution and audio switches
  • seedance-2.0-global-fast: faster/cheaper Seedance variant
  • wan-2.2: Wan 2.2 image-to-video endpoint with RunningHub's numeric field names

2. Prepare the inputs

  • If the user provides a local file path, pass it directly to the script. The script uploads it to POST /openapi/v2/media/upload/binary and reuses the returned download_url.
  • If the user provides a public URL or a data: URI, pass it through unchanged.
  • If the user wants stronger transition control and the chosen model supports it, include an end frame.

3. Submit and wait

Run the helper from the skill directory:

python "C:\Users\Administrator\.codex\skills\runninghub-video\scripts\runninghub_video.py" `
  --image "C:\path\to\start.png" `
  --prompt "镜头缓慢推进,人物抬头微笑,风吹动头发" `
  --out-dir "C:\path\to\outputs"

For start/end frame generation:

python "C:\Users\Administrator\.codex\skills\runninghub-video\scripts\runninghub_video.py" `
  --image "C:\path\to\start.png" `
  --end-image "C:\path\to\end.png" `
  --prompt "从平静站立过渡到转身回望,镜头平滑推进" `
  --duration 5 `
  --out-dir "C:\path\to\outputs"

4. Return useful output

When you finish, report:

  • which model/endpoint was used
  • the taskId
  • whether local images were uploaded first
  • the saved output path(s)
  • any prompt or parameter choices worth remembering

Command Patterns

Kling 3.0 std

python "C:\Users\Administrator\.codex\skills\runninghub-video\scripts\runninghub_video.py" `
  --model kling-v3.0-std `
  --image "C:\path\to\image.png" `
  --prompt "电影感镜头,小幅推近,人物表情逐渐变化" `
  --duration 5 `
  --cfg-scale 0.8 `
  --sound true

Seedance 2.0 global

python "C:\Users\Administrator\.codex\skills\runninghub-video\scripts\runninghub_video.py" `
  --model seedance-2.0-global `
  --image "C:\path\to\image.png" `
  --prompt "书页翻动时,文字化作发光蝴蝶飞散" `
  --resolution 720p `
  --ratio adaptive `
  --audio true `
  --real-person-mode true

Wan 2.2

python "C:\Users\Administrator\.codex\skills\runninghub-video\scripts\runninghub_video.py" `
  --image "C:\path\to\image.png" `
  --prompt "产品绕镜头缓慢旋转,补光扫过金属表面" `
  --duration 5 `
  --wan-resolution auto

Parameters Worth Tuning

  • --prompt: motion, camera movement, atmosphere, and audio intent
  • --duration: model-specific duration string; keep it to values shown in the official endpoint docs
  • --end-image: use when the endpoint supports start/end-frame control
  • --out-dir: always set an explicit output directory for easier follow-up work
  • --submit-only: use when the user wants a task id without waiting
  • --poll-interval and --timeout: useful for long renders

Troubleshooting

  • If upload fails, verify the local file exists and the API key is valid.
  • If the task returns moderation or content-verification errors, keep the same image but soften the prompt or remove risky wording.
  • If the task succeeds but no download happens, inspect the raw query response and the returned results array.
  • If the user asks for a model not covered by the helper yet, read references/api_reference.md, then extend the script instead of crafting a one-off request.

References

Comments

Loading comments...