ClawHub

Ai Gif Maker

v1.0.0

convert video clips or images into looping GIF files with this skill. Works with MP4, MOV, AVI, WebM files up to 200MB. marketers, social media creators, blo...

⭐ 0· 19·0 current·0 all-time
by@udnerc
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
The skill is a cloud-based GIF/MP4 rendering frontend and only asks for a single service token (NEMO_TOKEN) and API access to mega-api-prod.nemovideo.ai, which is coherent with converting and exporting media on a remote backend.
ℹ
Instruction Scope
Instructions tell the agent to check NEMO_TOKEN, obtain an anonymous token from the service if missing, create/persist a session_id, upload user media, stream SSE events, and poll render status. These are expected for a remote render workflow. The instructions also ask the agent to read this file's frontmatter and detect install path (~/.clawhub/ or ~/.cursor/skills/) to set an attribution header — reading the agent's install path is not strictly necessary for core functionality and is worth noting.
✓
Install Mechanism
No install spec or code files are present; this is instruction-only so nothing is written to disk by an installer. That minimizes install risk.
ℹ
Credentials
Only NEMO_TOKEN is declared as required, which matches a remote API integration. However, the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) that is not reflected in the registry metadata; the instructions imply storing session state but do not specify where. This mismatch could be benign bookkeeping but is worth confirming.
✓
Persistence & Privilege
always is false and the skill does not request elevated or platform-wide persistence. It asks to store a session_id for render jobs, which is reasonable for the task and scoped to the skill's backend interactions.
Scan Findings in Context
[no-code-to-scan] expected: The static scanner had no code files to analyze because this is an instruction-only skill. That is expected but means runtime behavior is defined entirely by the SKILL.md text.
Assessment
This skill appears to do what it says: upload media to a remote rendering service and return MP4/GIF exports. Before installing, consider: 1) The skill will call https://mega-api-prod.nemovideo.ai and may automatically create an anonymous token if you don't provide NEMO_TOKEN — verify you are comfortable with uploads going to that domain and review its privacy/terms. 2) Give a dedicated (revocable/ephemeral) NEMO_TOKEN rather than a token used elsewhere. 3) The SKILL.md references storing session state and a config path (~/.config/nemovideo/) in its frontmatter even though the registry metadata omitted that — ask the publisher how/where session tokens are stored and whether any files will be written. 4) If you want to avoid any filesystem checks, ask whether the platform-detection (checking ~/.clawhub/, ~/.cursor/skills/) can be skipped. If these points are acceptable or clarified, the skill's footprint is proportionate to its purpose.

Like a lobster shell, security has layers — review code before you run it.

latestvk973q1zpf8shxm7nn0hwffey5d84m8gz

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎞️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments