ClawHub

LovelyBots

v1.0.1

Generate TikTok-style talking videos from a script and image using the LovelyBots API. Queue a video, poll for completion, and retrieve a download URL — all...

⭐ 0· 83·0 current·0 all-time
byGeorge Gally@georgegally
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (TikTok-style talking videos) align with required env var (LOVELYBOTS_API_KEY), required binaries (curl, python3 for examples/polling), and documented API host (api.lovelybots.com). Nothing requested appears unrelated to video-generation.
✓
Instruction Scope
SKILL.md instructs the agent to POST to the API, poll GET /api/videos/:id, parse JSON (jq or python3), and return the video URL. It reads only the declared env var (LOVELYBOTS_API_KEY) and temporary headers files (removed via trap). No instructions to read unrelated files, other credentials, or exfiltrate data to unexpected endpoints.
✓
Install Mechanism
Instruction-only skill with no install spec or code files. This minimizes install-time risk because nothing is downloaded or written by the skill beyond normal agent runtime behavior.
✓
Credentials
Only LOVELYBOTS_API_KEY is required and declared as the primary credential, which is appropriate for an API-driven video generation skill. No unrelated secrets or broad filesystem config paths are requested.
✓
Persistence & Privilege
always is false and the skill is user-invocable only. There is no evidence it modifies other skills or system-wide settings; no persistent agent-level privileges are requested.
Assessment
This skill appears coherent and limited to calling the LovelyBots API. Before installing: (1) verify the LovelyBots domain and API docs yourself (https://lovelybots.com/openclaw) to confirm endpoints and behavior; (2) only provide an API key with the minimal scope needed and treat LOVELYBOTS_API_KEY as a secret (do not embed it in public repos); (3) avoid sending sensitive/private images to third-party services unless you accept the privacy/risk; (4) monitor API usage/credits after installation to detect unexpected calls; (5) if you need the agent to never call this skill autonomously, disable model invocation or control agent permissions—by default the platform allows autonomous invocation but this skill does not request elevated persistence. If any of the documented endpoints or responses differ from the live API, treat that as a red flag and do not proceed.

Like a lobster shell, security has layers — review code before you run it.

latestvk97cb8671mentqyag2kns909h583w2zj

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
Binscurl, python3
EnvLOVELYBOTS_API_KEY
Primary envLOVELYBOTS_API_KEY

Comments