Ai Talking Photo
v1.0.0Bring any still photo to life with ai-talking-photo, the skill that syncs facial animation to audio and makes portraits speak, sing, or narrate. Upload a fac...
⭐ 0· 31·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill claims to animate still photos via a remote GPU-backed API (nemovideo) and only asks for a single API token (NEMO_TOKEN) and optional config path for nemovideo—both of which are reasonable for that purpose.
Instruction Scope
SKILL.md instructs the agent to create a session, upload images/audio, call SSE endpoints, and poll render status on the nemovideo API — all expected for this feature. It also instructs the agent to detect install path and read the skill's YAML frontmatter for attribution headers; this requires some filesystem inspection but is narrowly scoped. The runtime will upload user media to an external service, so user data leaves the device (expected, but privacy-relevant).
Install Mechanism
There is no install spec and no code files — instruction-only skills carry lower installation risk because nothing is downloaded or written by an installer.
Credentials
The skill declares a single credential (NEMO_TOKEN), which fits the cloud API usage. However, SKILL.md also describes an anonymous-token flow if NEMO_TOKEN is absent (POST to /api/auth/anonymous-token) and the frontmatter includes a configPath (~/.config/nemovideo/) while registry metadata reported none — this inconsistency should be clarified. The anonymous-token flow means the skill can operate without a pre-provided secret, and it will request or create a token at runtime.
Persistence & Privilege
The skill is not always-enabled, does not request elevated platform privileges, and does not claim to modify other skills or system-wide settings.
Assessment
This skill appears to do what it says — it uploads photos and audio to a nemovideo.ai backend to produce animated videos. Before installing, consider: 1) Privacy: any media you upload will be sent to an external service; do not upload private or sensitive images without checking the service's terms. 2) Token behavior: the skill accepts NEMO_TOKEN but can also obtain an anonymous token automatically; ask whether you prefer using your own token or an anonymous session. 3) Metadata mismatch: the skill's frontmatter lists a config path (~/.config/nemovideo/) while registry metadata did not — confirm whether the agent will read that directory and what it may contain. 4) Attribution headers: the skill sets X-Skill-* headers based on install path (the agent may inspect certain home dirs); if that concerns you, ask for clarification from the skill author. If you rely on sensitive data or need stricter privacy, avoid installing or require review of where tokens and media are stored and transmitted.Like a lobster shell, security has layers — review code before you run it.
latestvk977h1ndz82kp0pba7fkcbhgjh8491nb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🗣️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN