kameo
v1.0.1Generate expressive talking-head videos from static images using Kameo AI. Converts static avatars/portraits into dynamic 5-second videos with realistic facial expressions, lip-sync, and motion. Use when you need to bring static images to life, create AI character videos, demonstrate visual communication, or generate talking avatars from photos.
⭐ 5· 1.9k·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The scripts implement the stated purpose (encode an image, call api.kameo.chat/generate), which is coherent. However the published registry metadata says no required env vars or binaries, while package.json lists required binaries (curl, jq, base64) and the scripts actually expect KAMEO_API_KEY (env or ~/.config/kameo/credentials.json) and optionally GOOGLE_API_KEY for prompt enhancement — these required credentials/env vars are not declared in the skill metadata, which is inconsistent.
Instruction Scope
Runtime instructions & scripts do more than just call Kameo: the enhance_prompt.sh script uploads the user's image to Google Generative Language (Gemini) using GOOGLE_API_KEY, and register.sh interacts with a Supabase instance to create accounts/keys. These external calls mean user images and credentials may be transmitted to services beyond api.kameo.chat; that behaviour is not fully documented in the skill metadata and is potentially privacy-sensitive.
Install Mechanism
There is no install spec (instruction-only), which minimizes arbitrary code downloads. However the package ships multiple shell scripts that will run locally; the lack of an install step is low risk in itself but you still must review and run these scripts manually. package.json lists required binaries (curl, jq, base64) which the runtime scripts actually use — the registry metadata omitted these.
Credentials
The scripts require KAMEO_API_KEY (and will read/write ~/.config/kameo/credentials.json). The prompt-enhancement path requires GOOGLE_API_KEY (used to call Gemini) but the skill metadata does not declare it. Additionally, the SKILL.md/USAGE.md embed a plaintext API key string (kam_...), which may be a leaked or placeholder credential — having a key visible in docs is risky. register.sh relies on SUPABASE_URL and SUPABASE_ANON_KEY placeholders; if these are left pointing to a third-party project they could send user credentials to an external Supabase instance.
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges. It stores its own API key into ~/.config/kameo/credentials.json (chmod 600) which is normal for CLI helpers. It does not attempt to modify other skills or system-wide settings.
What to consider before installing
Things to consider before installing or running this skill:
- Do not run the scripts blindly. Review generate_video.sh / enhance_prompt.sh / register.sh before executing.
- The skill requires a KAMEO_API_KEY (env or ~/.config/kameo/credentials.json) though the registry metadata omitted that. Set a dedicated key you control, and be ready to revoke it if needed.
- The enhance_prompt.sh script uploads your image to Google Generative Language (Gemini) and requires GOOGLE_API_KEY. If you don't want your images sent to Google (privacy/sensitivity), avoid the enhanced workflow or modify the script to use a local/alternative vision model.
- SKILL.md and USAGE.md include a plaintext API key-like string (kam_...); treat that as potentially exposed. Do not assume it is safe — if you paste that key into your environment you may be using someone else's credential. Prefer creating your own key via the service and rotate/revoke keys if you suspect reuse.
- register.sh uses SUPABASE_URL and SUPABASE_ANON_KEY placeholders. Do not run it without ensuring those values point to a project you control; the script will transmit email/password and create API keys via that backend.
- The scripts require curl, jq, and base64; ensure those binaries are present and review their usage.
- If you plan to proceed: run the scripts in an isolated environment (container or throwaway VM), avoid exposing sensitive images/identities, and monitor/limit network egress. If you need more assurance, ask the publisher for a canonical homepage/repository and a statement of which external services are contacted (Gemini vs optional) and why the example API key appears in docs.
Confidence is medium: the code matches the declared high-level purpose, but the undisclosed env requirements and embedded key are clear inconsistencies that warrant caution.Like a lobster shell, security has layers — review code before you run it.
latestvk97f2ba83eyr6ee10a8qczpxwd80ggma
License
MIT-0
Free to use, modify, and redistribute. No attribution required.