ClawHub

Image To Video In Gemini

v1.0.0

Get animated video clips ready to post, without touching a single slider. Upload your images (JPG, PNG, WEBP, HEIC, up to 200MB), say something like "turn th...

⭐ 0· 25·0 current·0 all-time
by@nemovideonemo
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The skill claims to convert images to short videos and only requests a NEMO_TOKEN and an optional local config path; those map directly to calls against mega-api-prod.nemovideo.ai described in the instructions, so the declared capabilities match the required credentials and endpoints.
ℹ
Instruction Scope
The SKILL.md instructs the agent to perform network calls (anonymous-token creation, session creation, SSE, uploads, polling exports) to mega-api-prod.nemovideo.ai and to persist a session_id. It also directs the agent to read the skill's YAML frontmatter and detect install path to populate attribution headers — which requires reading local skill metadata / path. These behaviors are coherent for attribution and session management, but are noteworthy because they entail automatic outbound network requests and reading the skill file/install path at runtime and will transmit user-supplied image files to a third-party service.
✓
Install Mechanism
No install spec or code is included (instruction-only). Nothing is downloaded or written by an installer, so there is low install-time risk.
✓
Credentials
Only a single credential (NEMO_TOKEN) is required and is directly used for authorization to the described API. The metadata lists a config path (~/.config/nemovideo/) which is consistent with storing session/config for this service. No unrelated secrets or cloud credentials are requested.
✓
Persistence & Privilege
always is false and the skill does not request system-wide changes. The runtime asks the agent to store a session_id/token for use while interacting with the service, which is normal and limited in scope.
Assessment
This skill appears internally consistent and does what it says: it will send images and control messages to mega-api-prod.nemovideo.ai to produce videos. Before installing, consider: (1) privacy: your images will be uploaded to a third-party service — avoid sending sensitive or private images unless you trust their policies; (2) network activity: the skill will automatically request an anonymous token and perform outbound HTTP(S) calls and SSE polling — if your environment restricts outbound traffic, expect those calls; (3) token lifecycle: anonymous tokens are short-lived (described as 7 days) and the skill will re-authenticate as needed; (4) attribution headers: the skill reads its frontmatter/install path to set X-Skill-* headers — this requires reading local skill metadata but not unrelated credentials; (5) trust the domain: verify the API hostname (mega-api-prod.nemovideo.ai) and service terms/privacy if you need stronger assurances. If you are comfortable with images being processed in that cloud service and with automatic network calls, the skill's behavior is proportional to its purpose.

Like a lobster shell, security has layers — review code before you run it.

latestvk974fjq0d1hrbvftgv0chj4yd98513q5

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments