by 安全扫描
OpenClaw
可疑
medium confidence该技能声明的目的（云端智能人像视频生成）与其指令大致一致，但存在不一致性和提示注入信号，安装或信任凭据前应谨慎。
评估建议
["验证技能来源和所有者——未提供主页或已知发布者。","确认域名（mega-api-prod.nemovideo.ai）对您打算使用的服务的合法性。","更推荐使用匿名令牌流（ephemeral tokens）而非将长期有效的 NEMO_TOKEN 放入环境中。","检查并确认为什么需要 ~/.config/nemovideo/（元数据注册表与 frontmatter 不匹配）。","仅在信任服务时才提供广泛或长期有效的凭据。","审查 SKILL.md 中的不可见/控制字符（扫描仪标记了 unicode-control-chars）。","先使用非敏感/假数据进行测试，并监控出站请求和日志。如果您不确定令牌范围或会话令牌的存储位置，请在开发人员澄清这些点之前不要安装或分享真实凭据。"]...详细分析 ▾
ℹ 用途与能力
The name/description (avatar video generation) aligns with the runtime instructions which call a nemovideo.ai rendering API and accept uploads. The skill declares NEMO_TOKEN as the primary credential which is consistent with a cloud API. However, the SKILL.md frontmatter requests a config path (~/.config/nemovideo/) while the registry metadata at the top listed no required config paths — this mismatch is incoherent and should be clarified.
⚠ 指令范围
The SKILL.md gives detailed runtime steps: use NEMO_TOKEN if present, otherwise obtain an anonymous token via POST to https://mega-api-prod.nemovideo.ai, create sessions, post SSE messages, upload user files, and poll renders. Those actions match the stated purpose, but the file contains a detected prompt-injection pattern (unicode-control-chars). The instructions also require the agent to 'auto-detect' an install path for X-Skill-Platform and to include attribution headers that must match the frontmatter — these add extra system probing (reading install path/frontmatter) and risk accidental leakage. The doc explicitly tells the agent not to print tokens, but it does not specify secure storage for tokens/session IDs.
✓ 安装机制
Instruction-only skill with no install spec and no code files; nothing will be written to disk by an installer. This is the lowest install risk.
⚠ 凭证需求
Only one required environment variable (NEMO_TOKEN) is declared, which is proportionate to a cloud API integration. However, there is an inconsistency: the registry summary says no required config paths, while the SKILL.md frontmatter lists ~/.config/nemovideo/ as a required config path. That suggests the skill may expect to read files from that directory (credentials/config) which increases sensitivity. The anonymous-token flow is provided as a fallback, which is preferable to requiring a long-lived token, but the skill does not explain secure handling of tokens.
ℹ 持久化与权限
The skill is not forced-always and does not declare system-wide persistence. It asks to persist a session_id (typical for remote APIs), but it does not ask to modify other skills or system settings. Default autonomous invocation is allowed (normal), so if you enable the skill it could be invoked without explicit user action — combine that fact with credential use if you are concerned.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/11
easy-avatar-video 1.0.0 — 初始发布 - 从文本、脚本或音频上传生成云端 AI 人像主持人视频。 - 支持快速上传 TXT、DOCX、PDF、MP3 文件（最多 200MB）。 - 输出 1080p MP4 视频，约 1–2 分钟；所有处理均在服务器端完成。 - 内置处理设置、会话、上传、导出、信用和状态管理。 - 无需拍摄；适合从脚本创建发言人视频的营销人员。 - 用户友好的工作流，用于创建、预览和导出人像视频。
● 无害
安装命令 点击复制
官方npx clawhub@latest install easy-avatar-video
镜像加速npx clawhub@latest install easy-avatar-video --registry https://cn.clawhub-mirror.com
技能文档
功能简介
基于云端的 Easy Avatar Video 工具，支持上传 TXT、DOCX、PDF、MP3 文件（最多 200MB），无需真人拍摄即可生成发言人视频。使用方法
- 上传文件（TXT、DOCX、PDF、MP3）
- 生成 1080p MP4 视频（约 1–2 分钟）
- 预览和导出视频
特点
- 云端处理，快速生成
- 支持多文件格式上传
- 无需真人拍摄，适合营销使用
# 原始 YAML frontmatter 不翻译 ...（保持原有，不翻译）
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制