ClawHub

Pika Ai

v1.0.0

generate text or images into AI generated clips with this pika-ai skill. Works with MP4, PNG, JPG, WebM files up to 200MB. content creators use it for genera...

⭐ 0· 73·0 current·0 all-time
by@dsewell-583h0
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description, endpoints, and the required NEMO_TOKEN align: the skill talks to nemovideo.ai to create sessions, upload media, and render videos. One minor inconsistency: the registry metadata lists no required config paths, but the SKILL.md frontmatter mentions a config path (~/.config/nemovideo/). This is likely non-critical but should be reconciled.
✓
Instruction Scope
SKILL.md stays on-topic: it only describes creating/refreshing a session token, posting uploads, streaming SSE, polling job state, and returning download URLs. It instructs the agent to generate a UUID for anonymous auth and to avoid exposing tokens. The skill also asks to derive an X-Skill-Platform header by detecting install path (reads install path conventions) — this requires some local path inspection but is limited in scope and understandable for attribution headers.
✓
Install Mechanism
There is no install spec and no code files — instruction-only. This minimizes disk-write/execution risk.
✓
Credentials
The only credential required is NEMO_TOKEN (primaryEnv). The SKILL.md also documents obtaining an anonymous token from the provider if the env var is absent. No unrelated secrets or multiple credentials are requested.
✓
Persistence & Privilege
always is false and the skill does not request system-wide changes or access to other skills' configs. It keeps session_id/token for its own operations (normal). Autonomous invocation is allowed (platform default) but not combined with other concerning privileges.
Assessment
This skill appears to do what it says: it sends images/text to a remote backend (mega-api-prod.nemovideo.ai) to generate 1080p MP4s and needs a NEMO_TOKEN (it can also obtain a short-lived anonymous token). Before installing, consider: 1) you will be uploading media (up to 200MB) to an external service—do not upload sensitive content you wouldn't want sent off-system; 2) the skill may inspect the agent install path to set an attribution header (reads local path conventions) — this is low-risk but note it reads local path information; 3) the SKILL.md frontmatter mentions a config path (~/.config/nemovideo/) while registry metadata omitted it — ask the publisher to clarify whether the skill will read or write that directory; 4) anonymous tokens expire after ~7 days and exports may be blocked by subscription/credit rules described in the doc. If you do not trust nemovideo.ai or cannot accept uploading your media, do not enable the skill. If you need higher assurance, request a homepage, privacy policy, or publisher verification (owner identity) before proceeding.

Like a lobster shell, security has layers — review code before you run it.

latestvk974y440g8pmk7das8a99e6j6984kkca

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments