by 安全扫描
OpenClaw
安全
medium confidenceThe skill's requests and runtime instructions are consistent with a cloud-based cartoon-video conversion integration that uses a single service token (NEMO_TOKEN); nothing in the SKILL.md indicates unrelated access or hidden behavior, though there are a couple of small metadata inconsistencies to be aware of.
评估建议
This skill is coherent with its stated purpose: it will use the NEMO_TOKEN (or acquire a short-lived anonymous token) to upload your media to nemovideo.ai, create render jobs, and return download URLs. Before installing, confirm you trust the nemo domain and are comfortable the service will receive the media you upload. Check where you store NEMO_TOKEN (environment vs agent config) and treat it like an API key — revoke it if you stop using the skill. Note the minor metadata mismatch (SKILL.md me...详细分析 ▾
ℹ 用途与能力
The skill is advertised as a cloud-based cartoon video converter and only asks for a single service credential (NEMO_TOKEN) and describes API endpoints that match that purpose. Note: the frontmatter in SKILL.md references a configPath (~/.config/nemovideo/) while the registry metadata lists no required config paths — this mismatch is likely benign but worth confirming.
✓ 指令范围
SKILL.md contains precise instructions for authenticating (including how to obtain an anonymous token), creating a session, uploading media, using SSE, exporting and polling for results. All referenced files, endpoints, and headers are directly related to converting and exporting media. The instructions explicitly tell the agent not to print tokens or raw JSON. There is some vague guidance about auto-detecting the platform from install path which could imply reading the agent install path, but this is minor and consistent with adding a platform header.
✓ 安装机制
No install spec or code files are included — this is instruction-only. That minimizes on-disk installation risk.
✓ 凭证需求
Only one environment variable (NEMO_TOKEN) is required and it is the credential for the documented API; SKILL.md also documents how to obtain a short-lived anonymous token if none is provided. There are no unrelated secrets requested.
✓ 持久化与权限
The skill is not always-enabled and does not request special system-wide privileges. It expects to maintain a session_id and job IDs for in-progress jobs (normal for a render service). Autonomous invocation is allowed by default (platform normal) but is not combined with any broad or unrelated access here.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/21
Automatic Generator Cartoon v1.0.0 — Initial Release - Instantly converts uploaded videos (MP4, MOV, AVI, WebM) to cartoon animation style via cloud rendering; outputs 1080p MP4. - Fully automatic workflow with no manual sliders or animation tools required. - Seamless setup using either user-provided or automatically generated API token (NEMO_TOKEN). - Supports uploads up to 500MB, multi-track editing (video, audio, text), and automatic timeline summaries. - Integrated session management, job status, credits/balance checks, and detailed error handling for common issues. - Designed for content creators wanting rapid, share-ready cartoon videos with minimal effort.
● 无害
安装命令
点击复制官方npx clawhub@latest install automatic-generator-cartoon
镜像加速npx clawhub@latest install automatic-generator-cartoon --registry https://cn.longxiaskill.com