Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

PixVerse AI Image and Video Generator

PixVerse CLI — generate AI videos and images from the command line. Supports PixVerse, Veo, Sora, Kling, Hailuo, Wan, and more video models; Nano Banana (Gem...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 30 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill description, commands, and capabilities align with an image/video-generation CLI (auth, create, task, asset commands). However the registry metadata lists no homepage or source repository while the SKILL.md repeatedly claims this is the "official" PixVerse CLI — that mismatch is unexplained and reduces trust.
Instruction Scope
Runtime instructions stay within the expected scope: installing/using a CLI, authenticating via OAuth device flow, storing tokens under ~/.pixverse/, uploading local files, and calling PixVerse APIs. The instructions do not ask the agent to read unrelated system files or exfiltrate arbitrary data.
!
Install Mechanism
There is no formal install spec in the package metadata, but SKILL.md tells users to run `npm install -g pixverse` or `npx pixverse`, which will fetch and run external code from the npm registry. Because the skill metadata provides no source repo or homepage to verify the package publisher, this is a moderate risk — installing arbitrary npm packages can execute arbitrary code on the machine.
Credentials
The skill requests no required environment variables and only documents a sensible optional override (PIXVERSE_TOKEN) and a local token store at ~/.pixverse/. Those are proportional to a CLI that needs to store an OAuth token. No unrelated credentials or broad system access are requested.
Persistence & Privilege
The skill is instruction-only (no code files in the registry bundle) and not marked always:true. It does instruct the CLI to store tokens under ~/.pixverse/, which is appropriate for a CLI. The skill does not request permanent platform-level privileges.
What to consider before installing
This README looks like a normal CLI for PixVerse, but the registry entry lacks a homepage or source repository. Before installing globally (npm install -g pixverse): - Verify the npm package owner and repository on https://www.npmjs.com/ (or prefer using npx for one-off use). Confirm the package's repository URL matches the official domain (pixverse.ai) and the publisher is legitimate. - Inspect the package contents (or its repository) before running it — npm packages can execute arbitrary code on install/start. - Prefer npx or running in a disposable/containerized environment if you can't confirm provenance. - Check the OAuth URL that appears during auth to ensure it points to app.pixverse.ai (not a malicious redirector) before completing authorization. - Be aware the CLI will store tokens under ~/.pixverse/ and optionally accept PIXVERSE_TOKEN — protect those credentials and don't set unrelated secrets for this skill. If you can confirm the package repo and publisher are legitimate (official PixVerse), the skill appears coherent and proportionate. If you cannot verify provenance, avoid installing globally.

Like a lobster shell, security has layers — review code before you run it.

Current versionv0.1.0
Download zip
latestvk97bp3qv93t1504eghkhw44jj5831h6t

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

PixVerse CLI — Master Skill

What is PixVerse CLI

PixVerse CLI is the official command-line interface for PixVerse — an AI-powered creative platform for generating videos and images. It is essentially a UI-free version of the PixVerse website: all features, models, and parameters are aligned with the web experience at app.pixverse.ai.

It is designed for:

  • AI agents (primary) — structured JSON output, deterministic exit codes, and pipeable commands for autonomous workflows (Claude Code, Cursor, Codex, custom agents)
  • Developers & power users — scriptable video/image generation without leaving the terminal
  • Automation — batch processing, CI/CD pipelines, content production workflows

Key facts:

  • Generating content consumes credits from the user's PixVerse account (same pricing as the website)
  • Only subscribed users can use the CLI — see subscription plans
  • All output can be returned as structured JSON via --json flag
  • English only

Installation

npm install -g pixverse

Or run without installing:

npx pixverse

Verify:

pixverse --version

Requires Node.js >= 20.


Quick Start

# 1. Install
npm install -g pixverse

# 2. Authenticate (OAuth device flow — opens browser)
pixverse auth login --json

# 3. Create a video (waits for completion by default)
RESULT=$(pixverse create video --prompt "A cat astronaut floating in space" --json)
VIDEO_ID=$(echo "$RESULT" | jq -r '.video_id')

# 4. Download the result
pixverse asset download $VIDEO_ID --json

To skip waiting and poll later:

RESULT=$(pixverse create video --prompt "A cat astronaut floating in space" --no-wait --json)
VIDEO_ID=$(echo "$RESULT" | jq -r '.video_id')
pixverse task wait $VIDEO_ID --json
pixverse asset download $VIDEO_ID --json

Authentication

PixVerse CLI uses OAuth device flow — no need to manually copy tokens:

  1. Run pixverse auth login --json
  2. The CLI prints an authorization URL
  3. Open the URL in your browser and authorize
  4. The token is stored automatically in ~/.pixverse/

Details:

  • Token is valid for 30 days
  • CLI sessions are independent from your web/app sessions
  • If token expires (exit code 3), re-run pixverse auth login --json
  • Set PIXVERSE_TOKEN environment variable to override the stored token
  • Run pixverse auth status --json to check login state and credits

Capabilities Overview

I want to...Use skill
Create a video from text or imagepixverse:create-video
Create or edit an imagepixverse:create-and-edit-image
Extend, upscale, or add audio to a videopixverse:post-process-video
Create transition animation between framespixverse:transition
Check generation progresspixverse:task-management
Browse, download, or delete assetspixverse:asset-management
Set up auth or check accountpixverse:auth-and-account
Browse and create from effect templatespixverse:template

Looking up models or parameters? Don't wait until you're generating — read the relevant capabilities file directly:

  • Video models & constraints → skills/capabilities/create-video.md (Model Reference section)
  • Image models & constraints → skills/capabilities/create-and-edit-image.md (Model Reference section)

Model Quick Reference

Use this to pick a model before diving into a sub-skill.

Video Models (pixverse create video --model <value>)

Model--model valueMax QualityDuration
PixVerse v5.6 (default)v5.61080p110s
Sora 2sora-2720p4 8 12s
Sora 2 Prosora-2-pro1080p4 8 12s
Veo 3.1 Standardveo-3.1-standard1080p4 6 8s
Veo 3.1 Fastveo-3.1-fast1080p4 6 8s
Grok Imaginegrok-imagine720p115s

Image Models (pixverse create image --model <value>)

Model--model valueMax Quality
Qwen Image (default)qwen-image1080p
Seedream 5.0 Liteseedream-5.0-lite1800p
Seedream 4.5seedream-4.52160p
Seedream 4.0seedream-4.02160p
Gemini 2.5 Flash (Nanobanana)gemini-2.5-flash1080p
Gemini 3.0 (Nano Banana Pro)gemini-3.02160p
Gemini 3.1 Flash (Nano Banana 2)gemini-3.1-flash2160p

For full parameter constraints (aspect ratios, quality per model, mode support), read the capabilities files listed above.


Workflow Skills

I want to...Use skill
Generate video from text end-to-endpixverse:text-to-video-pipeline
Animate an image into videopixverse:image-to-video-pipeline
Generate image then animate itpixverse:text-to-image-to-video
Iteratively edit an imagepixverse:image-editing-pipeline
Full video production (create + extend + audio + upscale)pixverse:video-production
Create multiple items in parallelpixverse:batch-creation

All Commands

CommandDescription
auth loginLogin via browser (OAuth device flow)
auth statusCheck authentication status
auth logoutRemove stored token
create videoText-to-video or image-to-video
create imageText-to-image or image-to-image
create transitionCreate transitions between keyframes
create speechAdd lip-sync speech to video
create soundAdd AI sound effects to video
create extendExtend video duration
create upscaleUpscale video resolution
create referenceGenerate video with character references
create templateCreate video or image from an effect template
template categoriesList template categories
template listBrowse templates (with optional category filter)
template searchSearch templates by keyword
template infoGet template details
task statusCheck task status
task waitWait for task completion
asset listList generated assets
asset infoGet asset details
asset downloadDownload a generated asset
asset deleteDelete an asset
account infoView account info and credits
account usageView credit usage records
subscribeOpen subscription page in browser
config listList all config values
config getGet a config value
config setSet a config value
config resetReset config to defaults
config pathShow config file path
config defaultsManage per-mode creation defaults

Global Flags

FlagDescription
--json or -pPure JSON output to stdout (required for agent use)
-V, --versionShow CLI version
-h, --helpShow help for any command

Every command supports --json. All examples in skills use --json for machine-readable output.

Interactive mode: Run any creation command without arguments (and without --json) to enter the interactive wizard.


Output Contract

JSON mode (--json)

  • stdout: Pure JSON only. No spinners, no progress text, no decorative output.
  • stderr: All errors, warnings, and diagnostic messages.
  • Parse stdout with jq or any JSON parser.

Exit Codes

CodeNameMeaningRecovery
0SUCCESSCompleted
1GENERAL_ERRORUnexpected errorCheck stderr for details
2TIMEOUTPolling timed outIncrease --timeout or use --no-wait then pixverse task wait
3AUTH_EXPIREDToken invalid/expiredRe-run pixverse auth login --json
4CREDIT_INSUFFICIENTNot enough creditsCheck pixverse account info --json, wait for daily reset or upgrade
5GENERATION_FAILEDGeneration failed/rejectedCheck prompt, try different parameters
6VALIDATION_ERRORInvalid parametersCheck flag values against enums in each skill

Error handling pattern

RESULT=$(pixverse create video --prompt "A sunset over mountains" --json 2>/tmp/pv_err)
EXIT_CODE=$?

if [ $EXIT_CODE -eq 0 ]; then
  VIDEO_ID=$(echo "$RESULT" | jq -r '.video_id')
  echo "Success: $VIDEO_ID"
  pixverse asset download $VIDEO_ID --json
elif [ $EXIT_CODE -eq 3 ]; then
  echo "Token expired, re-authenticating..."
  pixverse auth login --json
elif [ $EXIT_CODE -eq 4 ]; then
  echo "Not enough credits"
  pixverse account info --json | jq '.credits'
elif [ $EXIT_CODE -eq 5 ]; then
  echo "Generation failed — check prompt or parameters"
  cat /tmp/pv_err
else
  echo "Error (code $EXIT_CODE)"
  cat /tmp/pv_err
fi

Files

15 total
Select a file
Select a file to preview.

Comments

Loading comments…