← Back to Skills Marketplace
NovaVideo
by
onesoloapp
· GitHub ↗
· v1.0.1
· MIT-0
227
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install nova-video
Description
Generate images or videos using the Nova Video OpenAPI with a single sentence. Use when the user wants to generate an image, create a video, check video gene...
Usage Guidance
Before installing, consider the following: (1) The SKILL.md requires an API key (NOVA_API_KEY) but the registry metadata does not declare it — ask the publisher to update metadata to declare required credentials. (2) The install text instructs agents to fetch and 'activate' a remote SKILL.md from https://nova-video.onesolo.app; that lets the remote site change the skill behavior after registry approval — avoid installing unless you trust that domain and its update process. (3) Treat NOVA_API_KEY as sensitive: do not set it unless you trust the service's privacy and retention policies, and do not set NOVA_BASE_URL to an untrusted host (it would receive your API key). (4) If you need this functionality, prefer a skill whose SKILL.md and install files are served from the registry (or from a well-known, audited domain) and whose required env vars are declared in metadata. (5) If you proceed, review network traffic and logs to ensure requests go to the expected domain and limit how long an agent is allowed to poll (15 minutes of polling ties up resources).
Capability Analysis
Type: OpenClaw Skill
Name: nova-video
Version: 1.0.1
The skill provides image and video generation capabilities via the Nova Video API (nova-video.onesolo.app). It contains a shell injection vulnerability in the SKILL.md instructions, where the agent is directed to use curl with unsanitized variables (e.g., $IMAGE_URL and $IMAGE_RESP) derived from previous API responses. This pattern could allow a malicious or compromised API endpoint to execute arbitrary commands on the host system if the response contains shell metacharacters or command substitutions.
Capability Assessment
Purpose & Capability
The SKILL.md describes image and video generation via the Nova Video OpenAPI, which matches the skill name and description. However, the registry metadata declares no required env vars or primary credential while the runtime instructions clearly require NOVA_API_KEY (and optionally NOVA_BASE_URL). That mismatch is unexpected.
Instruction Scope
The install instructions explicitly tell agents to 'Read https://nova-video.onesolo.app/SKILL.md' (fetch and activate remote instructions). This allows a remote site to change behavior outside the registry. The SKILL.md also instructs long polling up to 15 minutes and saving long signed URLs to files — acceptable for the task but increases data-handling surface. The remote-fetch pattern and implicit trust in an external domain are the primary scope concerns.
Install Mechanism
There is no install spec or code to write to disk (instruction-only), which is lower-risk. However, the skill's install text encourages an agent to fetch a remote SKILL.md from an external domain rather than relying solely on registry content — that is an installation-time integrity concern even though no package is installed.
Credentials
Registry metadata lists no required env vars, but SKILL.md requires NOVA_API_KEY (and optionally NOVA_BASE_URL) to operate. Requiring an API key for an external service is reasonable, but the absence of this in metadata is an inconsistency. Also, NOVA_BASE_URL being user-configurable means a user (or attacker) could point requests — and the API key — to an arbitrary endpoint.
Persistence & Privilege
The skill is not always-enabled and does not request persistent system-wide config or other skills' credentials. Autonomous invocation is allowed (platform default) but isn't combined with other elevated privileges here.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install nova-video - After installation, invoke the skill by name or use
/nova-video - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.1
- Added a note about a free tier: every user now gets 60 free text-to-image generations per month at no cost.
- New "Install this skill" section with direct install and OpenClaw instructions.
- No changes to API or workflow; usage remains the same for generating images and videos.
v1.0.0
NovaVideo empowers creators to bridge the gap between imagination and reality. Seamlessly generate stunning AI visuals and transform them into professional grade videos with advanced scene control and motion synthesis.
v1.0.0 — Initial Release
New Feature: Text-to-Image Generation – Create high-fidelity visuals directly from natural language prompts.
New Feature: Image-to-Video Transformation – Animate static images into cinematic video sequences with advanced AI motion synthesis.
Stability Improvements – Optimized generation speed and visual consistency.
Metadata
Frequently Asked Questions
What is NovaVideo?
Generate images or videos using the Nova Video OpenAPI with a single sentence. Use when the user wants to generate an image, create a video, check video gene... It is an AI Agent Skill for Claude Code / OpenClaw, with 227 downloads so far.
How do I install NovaVideo?
Run "/install nova-video" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is NovaVideo free?
Yes, NovaVideo is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does NovaVideo support?
NovaVideo is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created NovaVideo?
It is built and maintained by onesoloapp (@onesoloapp); the current version is v1.0.1.
More Skills