The skill's stated purpose (convert images to videos) matches the network/API use, but there are inconsistencies in declared requirements and some instructions that warrant caution (automatic anonymous token issuance, hidden tokens, and implied filesystem probing).
评估建议
This skill will upload your images to a third-party API (mega-api-prod.nemovideo.ai) to render videos on cloud GPUs. Before installing or using it: (1) accept that image data will leave your device and be processed remotely; review the service's privacy/TOS if possible; (2) note the skill can auto-generate an anonymous NEMO_TOKEN if none is supplied — if you want tighter control, provide your own token rather than relying on auto-creation; (3) the SKILL.md asks the agent to detect install paths ...
详细分析 ▾
⚠用途与能力
The skill's name/description match the API actions described (upload images, render on cloud GPUs). However registry metadata lists NEMO_TOKEN as a required env var while the SKILL.md explicitly instructs the agent to obtain an anonymous token if NEMO_TOKEN is not set — that is inconsistent. The SKILL.md also declares a config path (~/.config/nemovideo/) in its frontmatter while the top-level registry metadata said no config paths are required.
⚠指令范围
Runtime instructions perform network calls to https://mega-api-prod.nemovideo.ai (expected for a cloud render service) and instruct the agent to: generate/store session tokens, include Authorization headers on every request, and detect install path to set an X-Skill-Platform header (this implies probing filesystem paths). The SKILL.md also tells the agent not to display raw API responses or token values to the user — hiding tokens from users can be reasonable but also can be used to obscure token-handling behavior. The instructions do not request unrelated secrets, but the install-path detection and the mismatch about config paths expand scope beyond just 'send image → get video.'
✓安装机制
Instruction-only skill with no install spec or code files — nothing is downloaded or written by an installer. This is the lowest install risk.
ℹ凭证需求
Only one credential is declared (NEMO_TOKEN), which is appropriate for a hosted rendering API. But the skill both declares NEMO_TOKEN as required and provides a full anonymous-token acquisition flow if the env var is missing — this mismatch should be clarified. The frontmatter also references a config path (~/.config/nemovideo/) which is not listed in the registry metadata; asking to read or use that path would increase privilege requirements and should be explained.
✓持久化与权限
always:false and normal autonomous invocation settings. The skill instructs to store a session_id for subsequent requests (expected for session-based APIs) but does not request permanent system-wide privileges or modification of other skills. No evidence it attempts to persist beyond its own session state, though storage behavior is not fully specified.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/20
Initial release of Best Image To Video — Convert Images Into Videos
- Convert images (JPG, PNG, WEBP, HEIC, up to 200MB) into 1080p MP4 videos in 30–60 seconds using remote GPU processing.
- Supports upload, video generation with custom prompts, credits check, export, and session management.
- Simple authentication with free 7-day token (100 credits); automatic backend setup for new users.
- Exports videos in formats suited for social media (MP4, MOV, etc.) with optional transitions, music, text overlays, and aspect ratio adjustments.
- Session-based workflow: upload images, describe your video, preview timeline, and download results.
- Clear feedback on errors (expired token, credits, unsupported files, limits) and specific tips for best results.
by