by 安全扫描
OpenClaw
安全
medium confidenceThe skill's declared purpose (cloud timelapse rendering) matches what its instructions request (an API token, session creation, uploads, render calls), with no extra unrelated credentials or installs, though there are a few small inconsistencies worth noting.
评估建议
This skill appears to do what it says: it uploads your images to a third‑party service (mega-api-prod.nemovideo.ai) and returns rendered MP4s. Before installing or using it, consider: (1) NEMO_TOKEN grants the skill access to your nemovideo account/credits—only provide a token if you trust that service; (2) images are uploaded to an external cloud service, so don't send sensitive photos you wouldn't want uploaded; (3) the skill may read its own SKILL.md frontmatter and attempt to detect install ...详细分析 ▾
✓ 用途与能力
The skill converts photo sequences into timelapse videos via the nemovideo cloud API; requiring a NEMO_TOKEN and calling render/upload endpoints is coherent with that purpose. One minor mismatch: the registry metadata listed no config paths, but the SKILL.md frontmatter declares a config path (~/.config/nemovideo/) — this is small but inconsistent.
ℹ 指令范围
SKILL.md provides concrete API flows: acquire or use NEMO_TOKEN, create session, upload files, use SSE, poll status, and include attribution headers. It also asks the agent to read the skill's YAML frontmatter and detect install path to set X-Skill-Platform; that requires local filesystem access to determine an install path and is out of the core 'upload/convert/download' happy-path but not disproportionate. The instructions telling the agent to 'keep technical details out of the chat' are operational guidance but not harmful.
✓ 安装机制
Instruction-only skill with no install spec or code files — lowest-risk install surface. No downloads or package installs are requested.
✓ 凭证需求
Only NEMO_TOKEN is declared as required (primary credential). The token is appropriate for a cloud rendering API. The skill will also generate an anonymous token if none is provided, which doesn't require extra secrets. No other unrelated secrets or keys are requested.
✓ 持久化与权限
always:false and normal autonomous invocation defaults. The skill does not request persistent system-wide changes or elevated privileges. It does instruct session management and will hold short-lived session/render IDs, which is expected.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/17
Initial release of Lapse Video skill. - Instantly converts 200 sequential photos into a 1080p timelapse MP4 video in under a minute. - Automatic backend connection and session management with user-friendly status updates. - Supports drag-and-drop uploads; simply describe your result—no manual timeline or export settings needed. - Utilizes cloud GPU rendering for fast, high-quality exports with support for text overlays, audio, and custom aspect ratios. - Exposes useful commands: upload, export, check credits, show timeline state. - Handles common user errors with clear guidance on accepted file types, credit issues, and session problems.
● 可疑
安装命令
点击复制官方npx clawhub@latest install lapse-video
镜像加速npx clawhub@latest install lapse-video --registry https://cn.longxiaskill.com 镜像可用