by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do what it says: it sends your text prompts and any uploaded images to mega-api-prod.nemovideo.ai to produce videos and needs a NEMO_TOKEN (or will fetch a short-lived anonymous token). Before installing, consider: 1) Privacy — any images or sensitive text you provide will be transmitted to the external service; avoid sending private data. 2) Credentials — supply a token you trust or review whether the anonymous token behavior is acceptable; the metadata's config path (~/.c...详细分析 ▾
ℹ 用途与能力
Name/description describe cloud video generation and the skill only asks for a single service credential (NEMO_TOKEN) and API endpoints consistent with that purpose. Minor oddity: metadata lists a config path (~/.config/nemovideo/) though the instructions already support using an env token or requesting an anonymous token — the config path may be for optional local config but is not strictly necessary.
ℹ 指令范围
SKILL.md instructs the agent to create/use a session, upload images/files, stream SSE responses, poll render status, and include attribution headers. These actions are appropriate for a remote video-generation service, but they do cause user text and uploaded images to be transmitted to the third-party API (mega-api-prod.nemovideo.ai). The skill also instructs the agent to read its own frontmatter and detect install paths to set X-Skill-Platform — reading the skill file/paths is reasonable but worth noting.
✓ 安装机制
Instruction-only skill with no install spec and no code files — nothing is downloaded or written to disk by an installer, which is the lowest-risk install model.
ℹ 凭证需求
Only one required environment variable (NEMO_TOKEN) is declared and used as the Bearer token for API calls — proportional to the task. The skill also describes obtaining an anonymous token via a POST if no token is present, which is expected behavior. The declared config path may allow reading saved credentials/config, which should be confirmed if you prefer not to expose local config.
✓ 持久化与权限
Skill does not request always:true, does not modify other skills, and has no install-time persistence. It can be invoked by the agent normally, which is expected for this type of integration.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/2
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install seedance-video-generator-free
镜像加速npx clawhub@latest install seedance-video-generator-free --registry https://cn.longxiaskill.com