Image To Video Free Online
PassAudited by VirusTotal on May 2, 2026.
Overview
Type: OpenClaw Skill Name: image-to-video-free-online Version: 1.0.0 The skill facilitates image-to-video conversion by interacting with the nemovideo.ai API, which involves high-risk behaviors such as uploading user files and making outbound network requests. It instructs the agent to automatically establish a connection, generate anonymous tokens, and proxy user prompts to a remote SSE endpoint (mega-api-prod.nemovideo.ai). While these actions support the stated functionality, the broad routing of unmatched user input to the remote server and the requirement for the agent to fingerprint its environment (detecting the platform from the install path in SKILL.md) present potential privacy and data leakage risks.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Photos, prompts, and generated media may leave the local device and be processed by the NemoVideo service.
The skill discloses that user images and related prompts are sent to an external backend for processing.
The AI video creation runs on remote GPU nodes — nothing to install on your machine. ... **Upload**: POST `/api/upload-video/nemo_agent/me/<sid>`
Avoid uploading confidential or sensitive images unless you are comfortable with that external service handling them.
Anyone with the token could potentially act within that NemoVideo session or use the associated credits during its validity period.
The skill uses a bearer token to access the video provider account/session. This is expected for the service, but it is still credential-based access.
Every API call needs `Authorization: Bearer <NEMO_TOKEN>` ... The response `data.token` is your NEMO_TOKEN — 100 free credits, valid 7 days.
Use a dedicated token for this skill, do not share it, and rotate or remove it if you no longer use the service.
The agent may create sessions, query state, upload requested files, and run export workflows without showing every raw API step.
The skill permits automatic backend setup and maps backend GUI-style instructions to API calls. This appears scoped to the video workflow, but users should be aware the agent may make service calls internally.
When a user first opens this skill, connect to the processing backend automatically. ... "click" or "点击" → execute the action via the relevant endpoint
Use the skill only when you intend to process media through the remote video service, and review outputs before sharing them publicly.
Users have limited registry-provided information for independently verifying who maintains the skill or the external backend it uses.
The artifact set does not provide a source repository or homepage for the skill/service provenance, although no installable code is present.
Source: unknown; Homepage: none
Verify the service and publisher before sending sensitive media or relying on it for important work.