ClawHub

Flova Video Generator

v0.2.9

Flova -- the world's first all-in-one AI video agent, handling scripting, storyboarding, asset generation, and rendering through a conversational interface....

⭐ 0· 123·0 current·0 all-time
by@flova
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description = Flova video agent; the only credential requested is FLOVA_API_TOKEN and the skill uses Flova API endpoints (service.flova.ai, s.flova.ai). Declared binary (curl) matches the SKILL.md helper. There are no extraneous credentials, binaries, or config paths.
ℹ
Instruction Scope
SKILL.md instructs the agent to call Flova endpoints (/user, /create, /chat, /export_video, etc.), poll status for long-running jobs, and fetch a remote VERSION_URL each invocation. These actions are coherent with video creation but involve repeated network calls and long polling (up to 20 minutes). The skill also recommends persisting the token via host mechanisms (settings/dotenv/shell profile). There are no instructions to read unrelated local files, other environment variables, or send data to third-party endpoints outside the declared Flova domains.
✓
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest install risk. SKILL.md expects curl (declared). No downloads, archives, or external installers are present.
✓
Credentials
Only FLOVA_API_TOKEN is required and is the primary credential for the Flova API; no other secrets or unrelated service credentials are requested. The token is used in Authorization headers as expected.
ℹ
Persistence & Privilege
always is false and the skill does not request system-level persistence. However, the SKILL.md permits autonomous behavior in 'fully-managed mode' for short videos (<= 1 minute) and advises persisting the token via host mechanisms — users should be aware the agent may act without repeated confirmations for minor creative choices and that persistent token storage should be handled securely.
Assessment
This skill appears to do exactly what it claims: call Flova's API using a single FLOVA_API_TOKEN. Before installing, confirm you trust https://www.flova.ai and only provide your FLOVA_API_TOKEN via secure mechanisms (do not paste it into public chat transcripts). Note the skill will poll Flova endpoints (including a remote version file at s.flova.ai) and may run longer polls for rendering jobs; this is normal for video exports but can use API credits and run for minutes. The skill can operate autonomously for short jobs and will auto-confirm minor creative options — if you want full control, disable autonomous use or require explicit confirmations in your agent settings. Finally, avoid storing the token in insecure shared shell profiles on multi-user machines; prefer the platform's secure secret storage or an encrypted dotenv solution.

Like a lobster shell, security has layers — review code before you run it.

latestvk975xdn10t72hdbrevgxvj5a3n83nmrr

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
Primary envFLOVA_API_TOKEN
Environment variables
FLOVA_API_TOKENrequired

Comments