ClawHub

Hailuo Ai Free

v1.0.0

Skip the learning curve of professional editing software. Describe what you want — generate a 5-second video clip of a sunset over the ocean from a text desc...

⭐ 0· 57·0 current·0 all-time
by@tk8544-b
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (AI video generation) match the declared requirement for a NEMO_TOKEN and the SKILL.md's API calls to mega-api-prod.nemovideo.ai. The declared config path (~/.config/nemovideo/) and the primaryEnv (NEMO_TOKEN) are coherent with a user/account-backed rendering service.
ℹ
Instruction Scope
Instructions explicitly direct the agent to create anonymous tokens if NEMO_TOKEN is absent, create sessions, send messages via SSE, and upload user files (multipart or URL). This is expected for a cloud render service, but it means user files and prompt content will be uploaded to the external API. The skill also suggests detecting an install path to set an X-Skill-Platform header — reading install-path info is minor but worth noting because it accesses local environment metadata.
✓
Install Mechanism
There is no install spec and no code files — instruction-only skills are lowest risk from an install perspective. No downloads or external packages are pulled.
✓
Credentials
Only one credential (NEMO_TOKEN) is required and is clearly used for API Bearer auth. The skill documents an anonymous token fallback when no environment token is present. No unrelated secrets or multiple unrelated env vars are requested.
✓
Persistence & Privilege
always is false (not force-installed) and the skill does not request elevated system-wide privileges. It does reference a per-skill config path, which is consistent with normal behavior.
Assessment
This skill will upload whatever prompts and files you provide to an external API (mega-api-prod.nemovideo.ai) for cloud rendering; that is expected but has privacy implications. Only supply files and text you are comfortable sending to a third party. Ensure any NEMO_TOKEN you provide belongs to the expected service and has appropriate permissions. Note the skill may read small pieces of local metadata (install path) to set a header — if you are concerned about disclosing filesystem layout, do not install or run the skill. If you want stronger assurance, ask the publisher for a privacy policy, verify the API domain, or avoid providing a persistent NEMO_TOKEN and rely on the anonymous-token fallback.

Like a lobster shell, security has layers — review code before you run it.

latestvk970j9ejz9b37m3tz00228r6dh84qzga

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments