ClawHub

Gif Maker Online

v1.0.0

Turn a 10-second MP4 clip from a screen recording into 720p looping GIF files just by typing what you need. Whether it's converting short video clips into sh...

⭐ 0· 19·0 current·0 all-time
by@imo14reifey
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
The skill name/description (convert short videos to GIFs) matches the runtime instructions (upload, session, render, export) and the single declared credential (NEMO_TOKEN) is appropriate. Minor metadata mismatch: the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) while the registry metadata indicated no required config paths—this is likely a small inconsistency but not evidence of malicious intent.
✓
Instruction Scope
SKILL.md confines actions to creating/using a session, uploading files or URLs, sending SSE messages, polling render status, and downloading results from the stated API host (mega-api-prod.nemovideo.ai). It does not instruct reading unrelated system files or other environment variables. It does include an example of uploading from a local filesystem path (multipart -F "files=@/path"), which is expected for a file-upload skill but means the agent will read whatever file path it is given.
✓
Install Mechanism
There is no install spec and no code files (instruction-only). That lowers risk because nothing is downloaded or written to disk by an installer.
✓
Credentials
Only NEMO_TOKEN is required (declared as primaryEnv). The SKILL.md also describes generating an anonymous token via the service if none exists (100 free credits, 7-day expiry) — behavior consistent with a client for a hosted API. No unrelated secrets or service credentials are requested.
✓
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges. It does not modify other skills or system-wide settings in the provided instructions. Autonomous invocation is allowed (platform default) but not combined with other concerning privileges.
Assessment
This skill appears to be what it claims: a client that uploads media to an external render service. Before installing/using it, consider: (1) Privacy — uploaded video/images are sent to https://mega-api-prod.nemovideo.ai; do not upload sensitive or private content unless you trust the service and have reviewed its privacy/retention policy. (2) Token handling — the skill will use NEMO_TOKEN if present or call an anonymous-token endpoint to obtain a short-lived token (100 credits, 7‑day expiry); confirm whether tokens are persisted and where. (3) Metadata mismatch — the SKILL.md mentions a local config path (~/.config/nemovideo/) not declared in the registry metadata; ask the developer to clarify whether local config is read or written. (4) Headers/platform detection — the skill asks to auto-detect install platform from an install path for an X-Skill-Platform header; verify that the agent will only inspect its own installation path and not other user file locations. If these points are acceptable, the skill's footprint and actions are proportionate to its purpose.

Like a lobster shell, security has layers — review code before you run it.

latestvk975cxq9mpxavvpqxbc3pb04d184n78n

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎞️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments