Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Dreamina Seedance

v1.0.1

Turn still images into dance videos using Dreamina SeedAnce. Upload a photo of a person, pick a dance style or describe the moves, and the AI generates a sho...

0· 115·0 current·0 all-time
bypeandrover adam@peand-rover

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for peand-rover/dreamina-seedance.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Dreamina Seedance" (peand-rover/dreamina-seedance) from ClawHub.
Skill page: https://clawhub.ai/peand-rover/dreamina-seedance
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install dreamina-seedance

ClawHub CLI

Package manager switcher

npx clawhub@latest install dreamina-seedance
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (turn images into dance videos) matches the runtime instructions and API endpoints. The declared primary credential (NEMO_TOKEN) also makes sense for an external cloud service. However, SKILL.md frontmatter mentions a config path (~/.config/nemovideo/) while the registry metadata lists no required config paths — a mismatch worth clarifying.
Instruction Scope
The instructions direct the agent to POST image files and metadata to mega-api-prod.nemovideo.ai and to call SSE endpoints; this is expected for a cloud rendering service but entails sending user images and possibly audio to an external server. The SKILL.md also describes anonymous-token generation and session management. There are no instructions to read unrelated local files, but the data upload/privacy surface is significant and should be explicit to users.
Install Mechanism
Instruction-only skill with no install spec and no code files — nothing is written to disk by an installer. This is the lowest install risk.
!
Credentials
Registry requires NEMO_TOKEN as the primary credential, but SKILL.md contains a free anonymous-token flow (generate UUID & POST) that would allow operation without an env token; that inconsistency is suspicious (is NEMO_TOKEN mandatory or optional?). The SKILL.md frontmatter also lists a config path (~/.config/nemovideo/) that the registry did not declare. Requesting a single service token is reasonable for the stated purpose, but the mismatch between declared requirements and runtime behavior should be resolved.
Persistence & Privilege
Skill is not always-enabled and does not request persistent system-wide privileges. It mentions storing session_id and tokens but does not instruct modifying other skills or system config; still, storage location and retention are unspecified.
What to consider before installing
This skill uploads user photos and other media to an external API (mega-api-prod.nemovideo.ai) to render videos — expect your images to leave your device. Before installing: 1) Ask the publisher to resolve inconsistencies (is NEMO_TOKEN required or optional? why does SKILL.md list ~/.config/nemovideo/ when registry does not?). 2) Confirm where session tokens and session_id are stored and how long media/credentials are retained on the backend. 3) If you must provide a permanent token, prefer a limited-scope or expendable token and check the service's privacy/terms. 4) Verify the API domain and publisher identity (no homepage provided). If you cannot verify these points or do not want images uploaded to an unknown service, do not install or use the skill.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

💃 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk97ergwfwn6jc2ah0z330d7htn84fsm3
115downloads
0stars
2versions
Updated 2w ago
v1.0.1
MIT-0

Getting Started

Dreamina SeedAnce is ready. Send a photo or describe the dance video you want.

Try saying:

  • "make this person dance hip hop"
  • "create a ballet sequence from my photo"
  • "animate a dance move from this image"

First-Time Setup

Connects to the backend on first use. Brief "Connecting..." message.

Token: Check for NEMO_TOKEN in env. If present, skip to session.

  1. Free token: Generate UUID. POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with X-Client-Id: <uuid>. Response data.token = 100 credits for 7 days.
  2. Session: POST https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth, body {"task_name":"project","language":"<lang>"}. Store session_id.

Don't print tokens or raw API data.

Generate Dance Videos from Photos

Upload a photo and describe what dance you want. The AI detects the person's pose, maps the motion, and renders frames on cloud GPUs.

Example use: uploaded a headshot, typed "make them do a salsa spin" and got a 4-second clip in about 45 seconds. Output was 1080p MP4 with smooth motion.

Full-body photos work much better than headshots. The more of the body visible, the more accurate the motion mapping.

Message Routing

Your inputHandlerSSE?
"export" / "download" / "save" / "导出"ExportNo
"credits" / "balance" / "积分"Credit checkNo
"status" / "show tracks" / "状态"StateNo
"upload" / file attached / "上传"UploadNo
Anything else (dance, animate, motion...)SSE pipelineYes

Backend

Photos go to GPU cluster. Motion model detects body keypoints and renders at 8Mbps for 1080p output.

Headers required on every call: Authorization: Bearer <NEMO_TOKEN>, X-Skill-Source, X-Skill-Version, X-Skill-Platform. Missing them = 402 on export.

Attribution from YAML: source = dreamina-seedance, version from frontmatter, platform from install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, else unknown).

Base: https://mega-api-prod.nemovideo.ai

Session: POST /api/tasks/me/with-session/nemo_agent{"task_name":"project","language":"<lang>"} — get task_id, session_id.

SSE: POST /run_sse{"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}}, Accept: text/event-stream. 15 min max.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — multipart -F "files=@/path" or URL {"urls":["<url>"],"source_type":"url"}.

Credits: GET /api/credits/balance/simpleavailable, frozen, total.

State: GET /api/state/nemo_agent/me/<sid>/latestdata.state.draft, data.state.video_infos, data.state.generated_media.

Export (free): POST /api/render/proxy/lambda{"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s. Done = status: completed. File at output.url.

Files accepted: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Errors

CodeProblemAction
0OKContinue
1001Token expiredGet new anonymous token
1002Session lostCreate new session
2001No creditsAnonymous: registration link (?bind=<id>). Paid: top up
4001File type rejectedShow accepted formats
4002Over 500MBCompress or crop
400No client IDGenerate and retry
402Free tier export capRegister or upgrade plan
429Rate limitedWait 30s, retry once

GUI Translation

Backend references visual elements. Convert them:

It saysYou do
"click [X]" / "点击"API call
"open [panel]" / "打开"Get state
"drag/drop" / "拖拽"SSE edit
"preview in timeline"Text summary
"Export button" / "导出"Export flow

SSE Details

Text → user (with GUI translation). Tool calls = internal. Heartbeats = working. "Still processing..." after 2 min quiet.

~30% of edits give no text back. Check state when stream closes empty, then summarize changes.

Draft keys: t (tracks), tt (video=0, audio=1, text=7), sg (segments), d (ms), m (metadata).

Timeline (2 tracks): 1. Video: dance sequence (0-4s) 2. Audio: music beat (0-4s, 60%)

Tips

Full-body photos give the best results. Head-only or waist-up shots limit what motions the AI can apply.

Simple dance moves render cleaner than complex choreography. Start with basic moves and iterate.

PNG with transparent background works best. Busy backgrounds may confuse the pose detector.

500MB max file size. Output is always 1080p MP4.

Comments

Loading comments...