Photo Video Maker
v1.0.4Turn a collection of still images into polished, shareable videos with the photo-video-maker skill. Upload your photos and let ClawHub sequence them into smo...
⭐ 0· 133·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill is an instruction-only wrapper for the NemoVideo rendering API and declares NEMO_TOKEN as its primary credential — this is appropriate for a photo-to-video service. Minor inconsistency: the SKILL.md metadata lists a configPaths requirement (~/.config/nemovideo/) while the registry summary above reported no required config paths. That mismatch looks like sloppy metadata management rather than malicious intent, but it should be clarified.
Instruction Scope
SKILL.md instructs the agent to create sessions, upload media, use SSE for generation, check state, and export via the NemoVideo API endpoints — all actions are directly related to building and exporting videos from photos. The doc does not instruct reading arbitrary system files or unrelated credentials. It does, however, require uploading user media to an external service (server-side rendering), which is expected but has privacy implications.
Install Mechanism
There is no install spec and no code files — instruction-only skills are lower risk because nothing is written to disk. No third-party downloads or package installs are declared.
Credentials
Only one environment variable is required (NEMO_TOKEN), which is proportional and expected for API authentication. No other credentials or broad-scoped secrets are requested. The presence of a configPaths entry in SKILL.md (see purpose_capability) could imply local config access; the registry metadata did not list that path, so confirm whether local config will be accessed and why.
Persistence & Privilege
The skill is not always-included and is user-invocable; it does not request persistent system privilege or installation. The skill can be invoked autonomously by the agent (platform default), which is normal — there are no additional privileges or system-wide config modifications requested.
Assessment
This skill appears to do what it says: it will upload your photos to NemoVideo's servers and require an API token (NEMO_TOKEN). Before installing, verify the token you provide is for NemoVideo and not a high-privilege or unrelated credential, review NemoVideo's privacy/retention policy (your images are sent off-device), and ask the skill author to clarify the configPaths entry (~/.config/nemovideo/) because registry metadata didn't list it. If you only want local processing, do not use this skill. If you proceed, consider using a limited-scope token and avoid sending sensitive images.Like a lobster shell, security has layers — review code before you run it.
latestvk9763nf30kpabrbn89smg1074h83x9mr
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎞️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN