安全扫描
OpenClaw
安全
high confidence该技能的要求和运行指令与基于云的照片转视频服务一致:需要单一服务令牌,描述了对命名后端的API调用,没有意外的安装步骤或无关的凭据请求。
评估建议
该技能似乎是如其名所示的云渲染管道:需要单一NEMO_TOKEN,否则会获取短期匿名令牌,并将图像发送到mega-api-prod.nemovideo.ai进行处理。安装或调用前,请注意:(1)在验证后端之前,不要提供高度敏感的图像或秘密;(2)如果不想分享永久令牌,请省略NEMO_TOKEN,允许技能使用匿名令牌流;(3)请注意,代理可能会尝试读取您提供的本地文件路径以上传图像,并可能检查技能文件/安装路径中的归属标头;(4)SKILL.md提到了其元数据中的配置路径,但注册列表没有——这是一个小的不匹配,但可能是信息性的。如果需要更强的保证,请要求发布者提供隐私/数据保留政策或先使用非敏感示例图像进行测试。...详细分析 ▾
✓ 用途与能力
Name/description (turn images into slideshow MP4 on cloud GPUs) align with the requested NEMO_TOKEN and the documented API endpoints on mega-api-prod.nemovideo.ai. One minor inconsistency: the registry metadata listed no required config paths, but the SKILL.md frontmatter includes a configPaths entry (~/.config/nemovideo/). This is likely bookkeeping/informational rather than a sign of unrelated capability.
ℹ 指令范围
The SKILL.md explicitly instructs the agent to use NEMO_TOKEN (or obtain an anonymous token via an API call) and to create sessions, upload files, poll render status, and handle SSE streams — all expected for a remote render service. Two items to note: (1) uploads include examples using multipart file paths (‑F "files=@/path"), which implies the agent may attempt to access local file paths when uploading — this is necessary for sending local images but means the agent could try to read filesystem paths the user provides; (2) the skill asks to read its YAML frontmatter and detect install path to set attribution headers, which requires inspecting the skill file and/or agent install path (fairly benign but broader file-system queries than strictly sending images). The instructions do not request unrelated environment variables or other system secrets.
✓ 安装机制
Instruction-only skill with no install spec and no code files — lowest-risk install footprint. There are no downloads, package installs, or archive extracts.
✓ 凭证需求
Only a single credential (NEMO_TOKEN) is required, which is proportional to a service that needs a bearer token for authenticated render jobs. The skill also supports obtaining an anonymous token via the service API if no token is provided. No unrelated secrets or multiple service credentials are requested.
✓ 持久化与权限
The skill does not request always:true and does not attempt to modify other skills or system-wide settings. It only documents runtime behavior (session creation, polling, SSE), which is normal for an API-backed skill.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/11
Fast Photo Video Maker 1.0.0 — 初始发布 - 即时转换JPG、PNG、HEIC或WebP图像(最多200MB)为1080p MP4幻灯片视频,云端渲染,30-60秒内完成。 - 云GPU驱动渲染——无需安装。 - 内置支持字幕、音乐和过渡编辑通过聊天提示。 - 免费匿名访问:获得100个视频信用,有效期7天,仅需一键注册。 - 设计为社交媒体创作者的简单上传、预览、编辑和下载工作流程。 - 自动错误处理和明确的身份验证、信用和文件处理状态更新。
● 可疑
安装命令 点击复制
官方npx clawhub@latest install fast-photo-video-maker
镜像加速npx clawhub@latest install fast-photo-video-maker --registry https://cn.clawhub-mirror.com
技能文档
请注意:由于SKILL.md内容较长且包含代码块、命令行指令和Markdown格式,以下仅提供简要中文概述,而非全文翻译。
Fast Photo Video Maker — 将图片转换为可分享的视频 发送您的图片和描述您想要的结果。AI视频创建运行在远程GPU节点——无需在您的机器上安装任何内容。快速示例:上传十张假期照片(JPG格式),输入“将我的照片转换为一个30秒的视频,包含音乐和过渡”,您将在大约30-60秒内获得一个1080p MP4视频。所有渲染发生在服务器端。值得注意的是,少于20张照片可以更快地处理并保持视频紧凑。
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制