ClawHub

Image To Video Bot

v1.0.0

convert images into animated video clips with this skill. Works with JPG, PNG, WEBP, HEIC files up to 200MB. marketers, social media creators use it for conv...

⭐ 0· 29·0 current·0 all-time
bypeandrover adam@peand-rover
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
The skill's name/description match the actions in SKILL.md (upload images, create render jobs, return MP4). It declares NEMO_TOKEN as the primary credential which is appropriate. Minor mismatch: the registry metadata reported no required config paths, but the SKILL.md metadata references ~/.config/nemovideo/ for attribution — this is likely benign but inconsistent and worth clarifying.
ℹ
Instruction Scope
Instructions stay within the stated purpose: establish a session, upload images, send SSE messages, poll render status, and return a download URL. The skill will read its YAML frontmatter for attribution and probe install-path patterns to set X-Skill-Platform (requires reading its own file path / environment), and will POST to an external API to obtain an anonymous token if NEMO_TOKEN is not present. These behaviors are coherent with its goals but do involve reading some local install-path info and sending user images to an external service.
✓
Install Mechanism
Instruction-only skill with no install spec or code files; nothing is downloaded or written during install. This is the lowest-risk install surface.
✓
Credentials
Only one credential (NEMO_TOKEN) is required and is clearly the service token used for API authorization. The SKILL.md also describes obtaining a short-lived anonymous token if none is provided, which reduces the need for additional secrets. No unrelated secrets or multiple credentials are requested.
✓
Persistence & Privilege
The skill is not always-enabled and does not request elevated or persistent platform privileges. It does not attempt to modify other skills or system-wide settings. The only persistent artifact implied is the server-side render job tied to the session token (expected for cloud rendering).
Assessment
This skill uploads your images to https://mega-api-prod.nemovideo.ai for cloud rendering and uses a NEMO_TOKEN (or it will request an anonymous token from that API). Before installing, confirm you trust that external service and avoid uploading sensitive or confidential images. If you have an account, prefer providing your own NEMO_TOKEN rather than relying on anonymous tokens. Also note a small manifest inconsistency (SKILL.md mentions a config path ~/.config/nemovideo/ while the registry metadata did not); you may wish to ask the publisher to clarify that. Overall the skill appears coherent and limited to its stated image→video purpose.

Like a lobster shell, security has layers — review code before you run it.

latestvk970gxqx5wgc6tjxz6jdc6ssc585015n

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments