Media Generation

Generate images, edit existing images, create short videos, run inpainting/outpainting and object-focused edits, use reference images as provider inputs, bat...

This skill appears to implement the advertised media generation and editing capabilities, but it expects (and will read/use) an OpenClaw configuration file and provider API keys/env vars even though the package metadata does not declare them. Before installing: 1) Inspect ~/.openclaw/openclaw.json (or $OPENCLAW_CONFIG) to see which provider keys would be used; do not provide high-privilege credentials unnecessarily. 2) Be aware the scripts will perform outbound HTTP requests and will download whatever URLs the provider returns (including internal or unexpected endpoints). Consider running the skill in a network-restricted sandbox if you want to limit egress. 3) If you plan to use the skill, create a least-privilege provider account (API key limited to media endpoints) and confirm the provider's URLs and behavior. 4) If the registry entry should declare required env vars/config paths, ask the publisher to add them; lack of declared credentials is an inconsistency and increases risk if you install without inspecting your config. If you want, I can list the specific files and lines that read the config or env vars so you can audit them more easily.

Type: OpenClaw Skill Name: media-generation Version: 2.2.0 The media-generation skill bundle is a legitimate and well-structured set of tools for AI-driven image and video creation and editing. It features robust scripts for API interaction, asynchronous job polling (generate_video.py), and complex image manipulations like inpainting and outpainting (mask_inpaint.py, outpaint_image.py). The bundle follows secure coding practices by using list-based subprocess calls to prevent shell injection and handles sensitive provider credentials via the standard OpenClaw configuration mechanism (media_request_common.py). No indicators of malicious intent, such as data exfiltration, unauthorized remote execution, or harmful prompt injection, were detected across the code or documentation.