Kling AI
v1.0.6Official Kling AI Skill. Call Kling AI for video generation, image generation, subject management, and account quota inquiry. Use subcommand video / image /...
⭐ 1· 381·0 current·0 all-time
byKling AI@klingai-dev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill is a CLI wrapper for Kling AI (video/image/element/account). Required binary (node) and the primary credential (KLING_TOKEN, plus optional AK/SK via credentials file) align with the described functionality and APIs hosted at klingai endpoints. The code calls the expected Kling API paths and contains model/route validation logic appropriate for a provider SDK/CLI.
Instruction Scope
SKILL.md and the scripts instruct the agent to run the included Node scripts and to read/write credential/env files under the Kling config directory (~/.config/kling or KLING_STORAGE_ROOT). That scope is appropriate for a CLI client, but it does mean the skill will read local credential files and may write credentials/kling.env and output media files. The SKILL.md explicitly forbids printing secrets; the code also avoids echoing secrets when saving credentials. This behavior is expected for this purpose but is material to user privacy and persistence.
Install Mechanism
No install spec is present (the skill is executed as included Node scripts). There are no remote downloads or package installs. Executing the skill will run local JavaScript files under the skill directory — expected for a packaged CLI skill.
Credentials
Primary credential KLING_TOKEN is appropriate and declared, and the code also supports AK/SK stored in ~/.config/kling/.credentials. Several optional environment variables are referenced (KLING_STORAGE_ROOT, KLING_ACCESS_KEY_ID, KLING_SECRET_ACCESS_KEY, KLING_API_BASE, KLING_MEDIA_ROOTS, KLING_ALLOW_ABSOLUTE_PATHS) but the top-level registry metadata lists no required env vars — that mismatch is a mild inconsistency. All requested/used envs are relevant to the skill's operation, not unrelated services.
Persistence & Privilege
The skill reads and writes files under the Kling config directory (credentials and kling.env) and will persist a probed KLING_API_BASE and saved AK/SK (when the user runs account --configure / import). It does not request always:true and does not modify other skills. Persisting credentials into the user's config directory is expected for a CLI client but is an important persistence characteristic the user should understand.
Assessment
This skill is a bundled CLI client for Kling AI and appears to do what it claims. Before installing or running it, consider:
- Provide only a Kling-specific token or credentials you trust this skill to use. The skill will read/write ~/.config/kling/.credentials and ~/.config/kling/kling.env (or the directory set via KLING_STORAGE_ROOT). If you are uncomfortable, set KLING_STORAGE_ROOT to a sandbox directory you control before first use.
- The skill will accept KLING_TOKEN (env), or AK/SK stored in credentials — saving AK/SK writes to disk (the CLI sets file permissions where possible). If you prefer not to store long-lived keys, use a short-lived token and remove it after use.
- SKILL.md and the code will read local media files (under cwd or KLING_MEDIA_ROOTS) and write outputs to your output directory; absolute-path access can be enabled by KLING_ALLOW_ABSOLUTE_PATHS=1 — avoid enabling that unless needed.
- Submitting generation jobs is billable; the skill enforces asking for confirmation on ambiguous requests, but you should still confirm costs before submitting.
- I noticed a small metadata inconsistency: top-level registry metadata listed no required env vars while the skill declares KLING_TOKEN as primary and references additional optional env vars. This is not malicious but worth noting.
If you want extra safety, review the included scripts locally (they are present in the package) or run the skill inside a restricted environment/container and set KLING_STORAGE_ROOT to a directory you control so credential files and kling.env cannot affect your real home config.Like a lobster shell, security has layers — review code before you run it.
latestvk97307ea9p3vy1xhwbdj11jeen8420cn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
Binsnode
Primary envKLING_TOKEN
