ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Photo to Video AI — Turn Images into AI Video Clips

v1.0.0

Transform static images into dynamic video content using AI animation and motion effects. This skill converts your photos, graphics, and still images into en...

⭐ 0· 85·0 current·0 all-time
by@nemovideonemo
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
✓
Purpose & Capability
Name and description match the declared behavior: converting images to animated videos via an external backend (NemoVideo). The skill is instruction-only and requests no local binaries or extra credentials, which is plausible for a thin wrapper that forwards user images to a remote API.
ℹ
Instruction Scope
The SKILL.md explicitly states it 'works by connecting to the NemoVideo AI backend at mega-api-prod.nemovideo.ai' and describes uploading photos, but it provides no runtime details: no authentication method, no API endpoints or request/response formats, and no guidance on where/how files are uploaded or how long they are retained. That lack of specificity increases the risk that the agent will send user data to an unknown third party without clear safeguards.
✓
Install Mechanism
Instruction-only skill with no install spec and no code files. This is low risk from an installation/execution perspective because nothing is written to disk by the skill itself.
ℹ
Credentials
The skill declares no required environment variables or credentials. For an API-based service this is plausible if the backend accepts unauthenticated uploads, but it's unusual — many video-processing APIs require an API key. The absence of an auth requirement is ambiguous: it could mean public, or it could mean the SKILL.md omitted necessary auth steps.
✓
Persistence & Privilege
No elevated privileges requested: always is false, the skill is user-invocable, and it does not claim to modify other skills or system settings. It does not request persistent presence or system configuration changes.
What to consider before installing
This skill appears to do what it says (send images to an external service to get animated videos), but it omits important details. Before installing or using it: 1) Verify the service domain (mega-api-prod.nemovideo.ai) and look for an official homepage or documentation — currently none is provided. 2) Ask the developer whether an API key or account is required and how authentication is handled. 3) Confirm how images are uploaded, where they are stored, and how long the provider retains them (privacy/retention). 4) Avoid sending sensitive or private images until you verify the service and its data-handling practices. If the skill cannot explain authentication and data retention, treat it as high-risk and do not use it with private content.

Like a lobster shell, security has layers — review code before you run it.

latestvk975hmqgn2d50a4731rqnd8fdd83fz7z

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis

Comments