by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's declared purpose (generate images) matches most of its instructions, but internal inconsistencies (manifest vs SKILL.md metadata), an unclear requirement for a long-lived credential, and the fact that it uploads user files to an external service make the package worth closer scrutiny before installation.
评估建议
This skill mostly does what it says — it calls a third-party API to render images/videos — but there are several things to verify before installing or using it:
- Confirm the discrepancy about config paths: SKILL.md's frontmatter mentions ~/.config/nemovideo/ but the registry metadata did not. Ask the publisher whether the skill will read that directory and why.
- Understand the NEMO_TOKEN behavior: the registry marks NEMO_TOKEN as required, yet SKILL.md explains an anonymous-token flow (the sk...详细分析 ▾
ℹ 用途与能力
The skill's name/description (AI image/video generation) aligns with the API endpoints and actions described in SKILL.md (session creation, SSE, upload, render/export). However there is an internal inconsistency: the registry summary lists no required config paths, but the SKILL.md frontmatter declares a configPath (~/.config/nemovideo/). That mismatch should be explained by the author.
ℹ 指令范围
SKILL.md stays focused on image/video generation: it directs the agent to create/refresh tokens, create sessions, upload media (including large user files), poll renders, and return download URLs. It does not instruct the agent to read unrelated system files or secrets. Two points to watch: (1) it tells the agent to 'auto-detect' platform from an install path (no install present) which may require filesystem inspection, and (2) it explicitly advises not to display raw API responses or token values to the user — this is reasonable for security but also reduces transparency for auditing.
✓ 安装机制
This is an instruction-only skill with no install spec and no code files, which minimizes on-disk risk. There is no downloader or executable install to review.
⚠ 凭证需求
The skill declares a single primary credential NEMO_TOKEN which is appropriate for a third-party rendering API. However: (a) SKILL.md describes a full anonymous-token flow that creates a token itself if NEMO_TOKEN is not set, making the 'required env var' claim inconsistent; (b) the frontmatter requests a user config path (~/.config/nemovideo/) that wasn't listed in the registry manifest — this suggests the skill may attempt to access local config files; and (c) because the skill uploads user files to a third-party API, sending any sensitive files would expose them externally. These points increase the privilege surface and deserve clarification.
✓ 持久化与权限
The skill is not always-enabled, has no install, and does not request elevated system-wide privileges. It stores session IDs/tokens for API interaction (normal for this type of integration).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/19
Free Image Creator 1.0.0 — Initial Release - Instantly generate AI images and 1080p videos from your text prompts—no sliders or complex controls. - Simple workflow: upload, describe, and get downloadable content complete with cloud GPU rendering pipeline. - Supports multiple formats (JPG, PNG, WEBP, MP4, and more); upload files up to 200MB. - Auto-connects and manages authentication (anonymous tokens, session handling). - Shows timeline summaries for edits and supports quick, batch, and iterative content creation. - Clear feedback and robust error handling for missing tokens, credits, or file issues.
● 无害
安装命令
点击复制官方npx clawhub@latest install free-image-creator
镜像加速npx clawhub@latest install free-image-creator --registry https://cn.longxiaskill.com