ClawHub

Image To Video Ai

v1.0.0

Transform static images into fluid, animated video sequences with ClawHub's image-to-video-ai skill. Upload a photo and describe the motion you want — camera...

⭐ 0· 68·0 current·0 all-time
by@udnerc
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The skill claims to animate images and all required items (NEMO_TOKEN, NEMO_API_URL, client_id persistence) are consistent with a hosted API-driven image-to-video service. There are no unrelated credentials or binaries requested.
ℹ
Instruction Scope
Instructions focus on creating sessions, uploading images, streaming renders, and exporting results to the nemovideo API, which matches the stated purpose. Minor scope notes: the runtime instructs the agent to persist ~/.config/nemovideo/client_id and to build a browser link that includes the token in the query string (token in URL can be exposed in logs or browser history). The skill also mandates custom headers (X-Skill-*) for every call — expected for attribution but means the agent will include skill metadata with requests.
✓
Install Mechanism
No install spec or code files are present (instruction-only), so nothing is downloaded or written by an installer beyond the documented client_id persistence. This is the lowest install-risk profile.
✓
Credentials
The only credential surface is the service token (NEMO_TOKEN) and an optional API URL and client ID; these are proportional for a hosted API. The skill declares a primaryEnv (NEMO_TOKEN) but also documents automatic anonymous-token generation if not provided — behavior is explained in the SKILL.md. No unrelated secrets or cross-service credentials are requested.
ℹ
Persistence & Privilege
The skill persists a non-secret UUID to ~/.config/nemovideo/client_id to avoid repeated anonymous-token requests — this is reasonable. The skill is not always-enabled and does not request system-wide privileges or modify other skills. Note that the agent will be permitted to call the external API (autonomous invocation is platform default); if you are concerned about autonomous network calls, consider restricting runtime permissions.
Assessment
This skill appears to do what it claims: it uses a NemoVideo API token and persists a non-secret client_id under ~/.config/nemovideo. Before installing: (1) Verify you trust nemovideo.com and the API endpoints used, since image uploads and generated videos are sent externally; (2) Be aware the generated browser preview link includes the token in the URL — treat that token as sensitive and revoke it if exposed; (3) If you prefer, create and set your own NEMO_TOKEN rather than relying on anonymous auto-generation; (4) If you do not want the agent making outbound API calls autonomously, limit the skill's runtime permissions or disable autonomous invocation in your agent configuration.

Like a lobster shell, security has layers — review code before you run it.

latestvk9779vjzrsmkbq3cxghdkbhj7s83ns1h

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎞️ Clawdis
Primary envNEMO_TOKEN

Comments