aivideomaker-test-api

Executes AIVideoMaker API workflows for text-to-video and image-to-video generation, including task creation, status polling, task details retrieval, and can...

Security Scan

The skill's code, instructions, and requested environment variables are coherent with its stated purpose of calling the AIVideoMaker API; only minor metadata inconsistencies and a couple of implementation notes were found.

Purpose & Capability

The skill's name, description, SKILL.md, manifest, and code all describe an AIVideoMaker API executor that uses an AIVIDEO_API_KEY and Node to run workflows. One small incoherence: the top-level registry summary lists no required binaries, while SKILL.md and clawhub.manifest.json declare 'node' as a required binary and the scripts are Node (ESM) programs. Also the registry metadata earlier showed 'Primary credential: none' while the skill actually treats AIVIDEO_API_KEY as the primary credential. These are configuration/metadata mismatches but align with the runtime behavior.

Instruction Scope

SKILL.md instructs running node scripts with a JSON payload and polling/cancelling tasks. The code reads only the declared environment vars (AIVIDEO_API_KEY, optional timeout and retries) and the provided --payload argument; it does not read arbitrary host files or other credentials. Network calls are restricted to the configurable baseUrl (default https://aivideomaker.ai).

Install Mechanism

There is no install spec (instruction-only skill plus included scripts). No remote downloads or archive extraction occur. The skill contains Node scripts that would run on the host if Node is available.

Credentials

Only AIVIDEO_API_KEY is required (plus optional AIVIDEO_TIMEOUT_MS and AIVIDEO_MAX_RETRIES). Those env vars are appropriate for a remote-API client. No unrelated credentials or broad system paths are requested. The client code does reference process.env and validates the presence of the API key.

Persistence & Privilege

The skill does not request 'always: true', does not modify other skills or system-wide configs, and contains no persistence or self-enabling behavior. It will perform outbound requests only when invoked.

Assessment

This skill appears to do what it says: call aivideomaker.ai endpoints and manage generate/status/cancel workflows. Before installing: 1) Fix the small metadata mismatches (registry listing vs SKILL.md/manifest) so the platform knows Node is required and AIVIDEO_API_KEY is the primary credential. 2) Confirm your runtime provides a Node environment with global fetch (the scripts assume a fetch API); if your Node is older (e.g., 14 or 16) you may need Node >=18 or to supply a fetch polyfill. 3) Provide a scoped/test API key first and monitor usage/quotas — the skill logs debug info and attempts to sanitize headers, but you should avoid passing your long-lived production key until tested. 4) Ensure outgoing network access to https://aivideomaker.ai is allowed and that your environment's secret storage is used for the API key. 5) If you need to be extra cautious, review network egress and runtime logs during a test run to confirm no unexpected endpoints or sensitive data are transmitted.

AIVideoMaker API Executor

Purpose

Provide a production-ready execution workflow for AIVideoMaker API v1:

• Create generation task
• Poll task status safely
• Fetch task details
• Cancel submitted task

When To Use

• User asks to call aivideomaker.ai API directly
• User wants a scriptable generation workflow
• User needs robust retry/429 handling for task queries

Required Environment

• AIVIDEO_API_KEY (required) Get an API Key from https://aivideomaker.ai .
• AIVIDEO_TIMEOUT_MS (optional, default 30000) - Request timeout in milliseconds
• AIVIDEO_MAX_RETRIES (optional, default 3) - Max retries for idempotent read requests

Supported Actions

1. createGeneration
2. getTask
3. getStatus
4. cancelTask

Model Whitelist

• t2v
• i2v
• lv
• t2v_v3
• i2v_v3

Image Input Policy

• This skill accepts both public image URLs and data:image/...;base64,... for i2v, lv, and i2v_v3.
• Prefer data:image/...;base64,... for reliability in OpenClaw environments.

Standard Workflow

1. Validate model and payload by contract.
2. Call createGeneration.
3. Poll getStatus with backoff until terminal status.
4. If COMPLETED, call getTask and return output.
5. If FAILED, return failure with actionable next steps.

Error Policy

• Normalize all responses to:
  • ok, status, taskId, data, errorCode, errorMessage, retryAfter
• Map API/runtime errors into stable error codes:
  • INVALID_MODEL
  • INVALID_PAYLOAD
  • AUTH_FAILED
  • RATE_LIMITED
  • INSUFFICIENT_CREDITS
  • TASK_NOT_FOUND
  • NETWORK_ERROR
  • UNKNOWN_ERROR

Execution Commands

• Run full workflow:
  • node scripts/run-workflow.mjs --model <model> --payload '<json_payload>'
• Query status:
  • node scripts/run-workflow.mjs --action getStatus --taskId <task_id>
• Query task details:
  • node scripts/run-workflow.mjs --action getTask --taskId <task_id>
• Cancel task:
  • node scripts/run-workflow.mjs --action cancelTask --taskId <task_id>

Security

This skill only performs the following actions:

• Calls the AIVideoMaker API with user-provided parameters
• Validates input payloads against a defined contract
• Reads only payload passed via --payload
• Does not read arbitrary host files, credentials, or sensitive system information
• Does not execute arbitrary code or shell commands

All network requests are made to https://aivideomaker.ai (or an optional custom base URL configured via client options) and include only the API key for authentication.

Security Best Practices:

• Never hardcode API keys in source code, configuration files, or skill archives
• Always pass the AIVIDEO_API_KEY as an environment variable
• Use secret management tools or platform-specific credential storage
• Regularly rotate API keys and monitor usage

Additional Resources

• Full API matrix: references/api-reference.md
• Usage and failure scenarios: references/examples.md