ClawHub

Photo Video

v1.0.0

Skip the learning curve of professional editing software. Describe what you want — turn these photos into a slideshow video with music and transitions — and...

⭐ 0· 62·0 current·0 all-time
bypeandrover adam@peand-rover
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (turn photos into slideshow videos) align with the declared requirement (NEMO_TOKEN) and the SKILL.md which documents photo uploads, session creation, render/export endpoints, and download URLs. No unrelated credentials or binaries are requested.
ℹ
Instruction Scope
Instructions are focused on connecting to the nemovideo cloud API, creating an anonymous token if needed, uploading media, and controlling render jobs. They require reading this skill's frontmatter for attribution headers and detecting an install path to set X-Skill-Platform, which entails reading the skill's install location (reasonable for attribution but notable). The skill will upload user images to an external service (mega-api-prod.nemovideo.ai) — expected for this purpose but a privacy consideration.
✓
Install Mechanism
Instruction-only skill with no install spec and no code files. This is the lowest-risk install model; nothing is downloaded or written by an installer.
✓
Credentials
Only a single credential (NEMO_TOKEN) is required, which is appropriate for a cloud rendering API. The skill also documents how to obtain a short-lived anonymous token if NEMO_TOKEN is absent. It does not request unrelated secrets or config paths beyond an optional service config directory for attribution metadata.
✓
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges. It instructs the agent to persist a session_id for the render session (expected) and does not modify other skills or system-wide settings.
Scan Findings in Context
[no-code-files] expected: The regex-based scanner had no files to analyze because this is an instruction-only skill (SKILL.md). No additional findings were produced.
Assessment
This skill appears to do what it says: it uploads your photos to a third‑party rendering service (mega-api-prod.nemovideo.ai) and returns a video. Before installing, consider privacy and credential hygiene: use an anonymous token (the skill documents how to obtain one) rather than reusing any long‑lived or sensitive API keys; avoid uploading sensitive images if you don't want them sent offsite; confirm the service's retention and privacy policies if that matters; and be aware the skill will store short‑lived session IDs. The attribution header behavior requires reading the skill's install location — not malicious but worth noting. If you need stricter data control, don't provide a persistent NEMO_TOKEN and verify the service domain independently.

Like a lobster shell, security has layers — review code before you run it.

latestvk974n5qnqz7whef43vxjf9frnn84nn6g

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🖼️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments