Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

keevx-image-to-video

v1.0.0

Convert images to videos using Keevx API with support for multiple models, resolutions up to 4K, audio generation, and batch processing.

9· 245·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for baidu-xiling/keevx-image-to-video.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "keevx-image-to-video" (baidu-xiling/keevx-image-to-video) from ClawHub.
Skill page: https://clawhub.ai/baidu-xiling/keevx-image-to-video
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install keevx-image-to-video

ClawHub CLI

Package manager switcher

npx clawhub@latest install keevx-image-to-video
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The SKILL.md describes an image-to-video converter using the Keevx API and the name/description align with that purpose. However, the runtime instructions require an external API key (KEEVX_API_KEY) and specific API endpoints, while the registry metadata lists no required environment variables or primary credential — an inconsistency between claimed requirements and declared metadata.
Instruction Scope
The instructions are narrowly scoped to uploading images, creating/querying image-to-video tasks, and optionally using callback URLs. They do not instruct reading unrelated system files or additional environment variables. Handling of local files (upload then use returned URL) and use of a callback URL are expected for async processing, but the callback mechanism could be abused if set to an attacker-controlled endpoint.
Install Mechanism
This is an instruction-only skill with no install spec or code files, so nothing is written to disk or automatically installed. That reduces installer-related risk.
!
Credentials
The SKILL.md clearly requires a single API credential (KEEVX_API_KEY) to call the Keevx API, which is proportionate to the described functionality. However, the registry metadata does not declare any required env vars or a primary credential — this mismatch is concerning because it hides the need to provide a secret. The skill otherwise does not request additional unrelated credentials.
Persistence & Privilege
The skill is not always-enabled and does not request special agent-wide configuration or persistent system privileges. Autonomous invocation is allowed (platform default) and is not by itself a problem here.
What to consider before installing
Before installing, note that the skill's documentation requires you to provide KEEVX_API_KEY even though the registry metadata omits it — that's an incoherence you should address. Confirm the skill's source and homepage (keevx.com and docs.keevx.com are referenced in the SKILL.md) and verify the domain and API documentation yourself. Only provide an API key with minimal privileges and avoid using sensitive or private images. Be careful with callback_url: if you supply a callback endpoint, ensure it is your controlled, HTTPS endpoint to avoid exfiltration. If possible, ask the publisher to update the registry metadata to declare KEEVX_API_KEY (and provide provenance) before trusting the skill. If you can't verify the publisher, treat it as higher risk and test with throwaway credentials and non-sensitive content first.

Like a lobster shell, security has layers — review code before you run it.

latestvk970q5yh0g7n6zjb3v9kpsxbm5833tkv
245downloads
9stars
1versions
Updated 13h ago
v1.0.0
MIT-0

Keevx Image-to-Video Skill

Convert images to high-quality videos via the Keevx API.

Prerequisites

Set the environment variable KEEVX_API_KEY, obtained from https://www.keevx.com/main/home. Documentation: https://docs.keevx.com

export KEEVX_API_KEY="your_api_key_here"

API Endpoints

  • Base URL: https://api.keevx.com/v1
  • Upload image: POST /figure-resource/upload/file (Content-Type: multipart/form-data)
  • Create task: POST /image_to_video (Content-Type: application/json)
  • Query status: GET /image_to_video/{task_id}
  • Auth: All endpoints use Authorization: Bearer $KEEVX_API_KEY
  • Source identifier: All endpoints require the source: skill Header

Model Selection

ParameterModel V (General, Recommended)Model KL (Multi-Reference)
prompt✅ Required, max 1000 chars✅ Required
image_urlRequired for single-image mode, max 20MB❌ Not supported
reference_imagesRequired for multi-image mode, max 3 images, each max 20MB✅ Required, max 7 images, each max 20MB
aspect_ratio✅ 16:9 / 9:16✅ 16:9 / 9:16
aspect_resolution720p / 1080p / 4k720p / 1080p
durationSingle-image: 4/6/8s, Multi-image: fixed 8s5 / 10s
generate_audio✅ Supported, default false❌ Not supported
generate_countOptional 1-4Optional 1-4
callback_urlOptionalOptional

Model Selection Guide

  • Choose Model V: When audio is needed, 4K resolution required, single or multi-image input, high quality requirements
  • Choose Model KL: When multiple reference images are available (2-7), multi-angle showcase needed, product demo videos

Model-Specific Request Bodies

Model V

{
  "model": "V",
  "prompt": "Video description (required, max 1000 chars)",
  "image_url": "https://... (required for single-image mode)",
  "reference_images": ["https://..."],
  "aspect_ratio": "16:9",
  "aspect_resolution": "720p | 1080p | 4k",
  "duration": 4,
  "generate_audio": true,
  "generate_count": 1
}

Model KL

{
  "model": "KL",
  "prompt": "Video description (required)",
  "reference_images": ["https://..."],
  "aspect_ratio": "16:9",
  "aspect_resolution": "720p | 1080p",
  "duration": 5,
  "generate_count": 1
}

Image Input Handling

User-provided images may be URLs or local file paths, handle accordingly:

  • URL (starts with http:// or https://): Use directly as image_url or reference_images
  • Local file path: Upload via the upload endpoint first, then use the returned URL

Upload Local File

curl --location 'https://api.keevx.com/v1/figure-resource/upload/file' \
  --header 'Authorization: Bearer $KEEVX_API_KEY' \
  --header 'source: skill' \
  --form 'file=@"/path/to/local/image.png"'

Response example:

{
  "code": 0,
  "success": true,
  "message": { "global": "success" },
  "result": {
    "url": "https://storage.googleapis.com/..../image.png",
    "fileId": "c5a4676a-...",
    "fileName": "image.png"
  }
}

Extract the image URL from result.url for use as image_url or reference_images. For multiple local files, upload each one and collect all URLs.

Quick Examples

Single Image Generation (Model V)

curl -X POST "https://api.keevx.com/v1/image_to_video" \
  -H "Authorization: Bearer $KEEVX_API_KEY" \
  -H "source: skill" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "V",
    "prompt": "Waves crashing on the beach at sunset",
    "image_url": "https://example.com/beach.jpg",
    "aspect_ratio": "16:9",
    "aspect_resolution": "1080p",
    "duration": 6,
    "generate_audio": true
  }'

Multi-Reference Image Generation (Model KL)

curl -X POST "https://api.keevx.com/v1/image_to_video" \
  -H "Authorization: Bearer $KEEVX_API_KEY" \
  -H "source: skill" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "KL",
    "prompt": "City night timelapse, neon lights flickering",
    "reference_images": [
      "https://example.com/city1.jpg",
      "https://example.com/city2.jpg",
      "https://example.com/city3.jpg"
    ],
    "aspect_ratio": "16:9",
    "aspect_resolution": "1080p",
    "duration": 10,
    "generate_count": 2
  }'

Query Task Status

curl -X GET "https://api.keevx.com/v1/image_to_video/i2v-xxxxxxxx" \
  -H "Authorization: Bearer $KEEVX_API_KEY" \
  -H "source: skill"

Response Format

Task Created Successfully

{
  "code": 0,
  "msg": "ok",
  "data": {
    "task_ids": ["i2v-d6b6472bcf724d0399e06d1390cb964e"]
  }
}

Task Query Success

{
  "code": 0,
  "msg": "ok",
  "data": {
    "task_id": "i2v-d6b6472bcf724d0399e06d1390cb964e",
    "status": "SUCCEEDED",
    "video_url": "https://storage.googleapis.com/.../sample_0.mp4",
    "thumbnail_url": "https://storage.googleapis.com/.../thumbnail.webp",
    "error_message": "",
    "duration": 6,
    "width": 1920,
    "height": 1080
  }
}

Status Values

PENDING (queued) / PROCESSING (in progress) / SUCCEEDED (completed) / FAILED (failed)

Failure Response

{
  "code": 100001,
  "msg": "Parameter error: prompt cannot be empty"
}

Callback Notification

Provide callback_url when creating a task. The system will send a POST request to that URL upon task completion:

{
  "code": 0,
  "msg": "ok",
  "task_type": "image_to_video",
  "data": {
    "task_id": "i2v-d6b6472bcf724d0399e06d1390cb964e",
    "status": "SUCCEEDED",
    "video_url": "https://storage.googleapis.com/.../sample_0.mp4",
    "thumbnail_url": "https://storage.googleapis.com/.../thumbnail.webp",
    "error_message": ""
  }
}

Polling Strategy

Video generation may take up to 20 minutes. Recommended: 30-second intervals, max 40 retries.

MAX_RETRIES=40
INTERVAL=30

for i in $(seq 1 $MAX_RETRIES); do
  status=$(curl -s -X GET "$API_BASE/image_to_video/$TASK_ID" \
    -H "Authorization: Bearer $KEEVX_API_KEY" \
    -H "source: skill" | jq -r '.data.status')

  if [ "$status" = "SUCCEEDED" ]; then echo "Success"; break
  elif [ "$status" = "FAILED" ]; then echo "Failed"; break; fi

  sleep $INTERVAL
done

Error Codes

HTTP Status CodeDescription
200Success
400Parameter error
401Authentication failed
404Resource not found
413Request body too large
429Rate limit exceeded
500Internal server error
Business Error CodeDescriptionSolution
100001Parameter errorCheck parameter format and required fields
100002Invalid tokenVerify API Key is correct and active
100003Task not foundVerify task_id is correct
100004Image size exceededCompress image to under 20MB
100005Prompt too longShorten prompt to within 1000 characters
100006Image URL inaccessibleEnsure image URL is publicly accessible
100007Unsupported image formatUse common formats such as JPG, PNG

Notes

  • Generated video/thumbnail URLs are retained for 7 days only; download promptly
  • Max image size: 20MB, supported formats: JPG/PNG/WebP
  • Max prompt length: 1000 characters
  • 429 error: retry after 30s; 500 error: retry after 10s; network error: retry immediately, max 3 times
  • Prompt tips: describe subject, scene, action, mood; include visual details (lighting, color, texture)
  • Narration script: to add narration to the video, use Speak "narration content" in the prompt, e.g. Speak "Welcome to our channel"
  • Image tips: use high-resolution, subject-focused, evenly-lit, well-composed images

Comments

Loading comments...