Photo Video Maker Italiano
v1.0.0Italian-speaking content creators create photos and images into slideshow video MP4 using this skill. Accepts JPG, PNG, HEIC, MP4 up to 500MB, renders on clo...
⭐ 0· 64·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill claims to render photos into slideshow MP4s on a cloud GPU service and all declared runtime actions (auth, session creation, upload, render/export endpoints) target a single external API (mega-api-prod.nemovideo.ai). Requesting a single service token (NEMO_TOKEN) is proportional to that purpose.
Instruction Scope
The SKILL.md gives detailed API workflows (create session, SSE chat, upload, export) and only asks to handle user media and session tokens. It instructs the agent to read this file's YAML frontmatter and to detect install path to set attribution headers — these require reading skill metadata and possibly the agent's install path. This is reasonable for adding attribution headers but is a minor scope expansion (reading its own metadata and install location). There are no instructions to read unrelated system files or other environment variables.
Install Mechanism
No install spec or code files are present; this is an instruction-only skill. Nothing will be downloaded or written to disk by an installer step.
Credentials
The only required credential is NEMO_TOKEN (declared as primaryEnv), which matches the described API usage. One inconsistency: the SKILL.md frontmatter metadata lists a config path (~/.config/nemovideo/) while the registry metadata reported 'Required config paths: none'. Accessing a per-service config directory could be reasonable (cached tokens/settings), but the mismatch between registry metadata and the skill frontmatter should be clarified before trusting the skill to read that path.
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges. It instructs saving session_id for ongoing jobs and to reuse an existing NEMO_TOKEN if present — standard behavior for a session-based cloud service.
Scan Findings in Context
[no-findings] expected: The static regex scanner had no code files to analyze. This is expected for an instruction-only skill; absence of findings is not evidence of safety beyond what the SKILL.md describes.
Assessment
This skill appears to do what it says: it uploads user media to a nemovideo cloud API and returns rendered MP4s. Before installing or using it: 1) Confirm you trust the external domain (mega-api-prod.nemovideo.ai) and understand their privacy/storage policy for uploaded images/videos. 2) Be aware the skill will use a NEMO_TOKEN (you can provide one or let it obtain an anonymous ephemeral token). 3) Ask the publisher to clarify the config-path discrepancy (the skill's frontmatter references ~/.config/nemovideo/ while registry metadata did not) if you want to prevent any filesystem reads. 4) Avoid sending highly sensitive images unless you have verified the service's data-retention and access controls.Like a lobster shell, security has layers — review code before you run it.
latestvk97fmvp57azwsc229482xwc83584mzwc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎞️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN