An OpenClaw skill for AI-powered multimedia generation (image, video, audio, 3D) via 170+ RunningHub API endpoints — zero dependencies, pure Python.
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This is a coherent RunningHub media-generation skill, but users should be aware it uses a paid API key, can save that key locally, and uploads prompts or media to RunningHub.
Install only if you are comfortable giving this skill a RunningHub API key and sending generation inputs to RunningHub. Use a dedicated API key, watch your balance, and avoid uploading private or sensitive media unless you trust the selected RunningHub app.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A saved RunningHub key can be reused for future generation jobs and may spend the user's RunningHub balance.
The skill can persist the user's RunningHub API key in the local OpenClaw config. This is purpose-aligned for a paid RunningHub integration, but it grants ongoing account access.
When user sends a key, verify with `--check --api-key THE_KEY`. If valid, save it: ... ['apiKey'] = 'THE_KEY'
Use a dedicated, revocable RunningHub API key, remove or rotate it when no longer needed, and avoid saving it if you only wanted one-time use.
Images, audio, video, or other uploaded files may be processed by RunningHub or a selected RunningHub AI application.
The AI app flow uploads local files to RunningHub. This is necessary for image/audio/video processing, but it means user media leaves the local environment.
UPLOAD_PATH = "/task/openapi/upload" ... "-F", f"file=@{file_path}"Only upload files you are comfortable sending to RunningHub, and verify the webappId or app link before running a custom AI application.
A mistaken endpoint, model, or app ID could generate unwanted output, upload the wrong input, or consume RunningHub credits.
The skill exposes a broad paid API surface, including arbitrary RunningHub AI apps by ID. This is disclosed and aligned with the stated purpose, but incorrect choices can run unintended jobs.
Generate images, videos, audio, and 3D models via RunningHub API (170+ endpoints) and run any RunningHub AI Application (custom ComfyUI workflow) by webappId.
Confirm the selected model or AI app and be mindful of balance/cost before asking the agent to run generation tasks.