by 安全扫描
OpenClaw
可疑
medium confidenceThe skill mostly behaves like a text→video client (network calls, uploads, session tokens) but contains small metadata inconsistencies and asks the agent to transmit user content and create anonymous tokens against an external API — review before installing.
评估建议
This skill will upload your prompts and any files you provide to an external service (mega-api-prod.nemovideo.ai) and will request or mint short-lived tokens to operate. That behavior is consistent with a cloud video-generation tool, but you should: (1) avoid sending sensitive content (private data, secrets, PII) to the service; (2) prefer using an anonymous token or a dedicated limited-scope token rather than a long-lived production token; (3) ask the publisher for the official homepage, privac...详细分析 ▾
ℹ 用途与能力
Name/description (text→video) match the runtime instructions (upload, SSE, render, export). Requiring NEMO_TOKEN is expected. However the skill frontmatter lists a config path (~/.config/nemovideo/) while the registry metadata reported none — this mismatch is inconsistent. The skill also provides an anonymous-token fallback if NEMO_TOKEN is absent, which is plausible but makes the declared 'required env var' semantics a bit ambiguous.
ℹ 指令范围
SKILL.md explicitly instructs the agent to: check environment for NEMO_TOKEN, optionally POST to an external auth endpoint to obtain an anonymous token, create sessions, upload files (multipart or URL), and stream SSE responses. All of this is coherent with video generation. The important runtime behavior is that user prompts/files are sent to https://mega-api-prod.nemovideo.ai — this is expected but has privacy implications. The instructions are somewhat vague about the exact attribution headers (mentions 'three attribution headers above') and about how long tokens/sessions are persisted.
✓ 安装机制
Instruction-only skill with no install spec or code files — lowest install risk. Nothing written to disk by an install step in the package itself.
ℹ 凭证需求
Only one declared env var (NEMO_TOKEN) — appropriate for a cloud API client. However the SKILL.md will obtain an anonymous token by calling the service if NEMO_TOKEN is missing, so the practical need for providing your own token is optional. The frontmatter's mention of a config path (~/.config/nemovideo/) (missing from registry metadata) suggests the skill may try to read user config for attribution — this should be clarified before trusting it with sensitive config files.
✓ 持久化与权限
No 'always: true'. The skill instructs keeping session_id in memory for operations but does not request system-wide persistent privileges. Autonomous invocation is allowed by default but not combined here with elevated privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/20
- Initial release of Video Generation Online: create and download 1080p videos from text prompts or images in 1–2 minutes. - Automatic cloud backend setup with secure, token-based authentication (100 free credits for new users). - Supports text-to-video, quick edits, and batch/bulk video processing workflows without complex timelines or export steps. - File uploads, session state, exports, and credits management streamlined via one unified interface. - Includes clear error handling, supported formats (mp4, mov, jpg, etc.), and detailed prompt/action routing.
● 无害
安装命令
点击复制官方npx clawhub@latest install video-generation-online
镜像加速npx clawhub@latest install video-generation-online --registry https://cn.longxiaskill.com