NovaVideo

Generate images or videos using the Nova Video OpenAPI with a single sentence. Use when the user wants to generate an image, create a video, check video gene...

Before installing, consider the following: (1) The SKILL.md requires an API key (NOVA_API_KEY) but the registry metadata does not declare it — ask the publisher to update metadata to declare required credentials. (2) The install text instructs agents to fetch and 'activate' a remote SKILL.md from https://nova-video.onesolo.app; that lets the remote site change the skill behavior after registry approval — avoid installing unless you trust that domain and its update process. (3) Treat NOVA_API_KEY as sensitive: do not set it unless you trust the service's privacy and retention policies, and do not set NOVA_BASE_URL to an untrusted host (it would receive your API key). (4) If you need this functionality, prefer a skill whose SKILL.md and install files are served from the registry (or from a well-known, audited domain) and whose required env vars are declared in metadata. (5) If you proceed, review network traffic and logs to ensure requests go to the expected domain and limit how long an agent is allowed to poll (15 minutes of polling ties up resources).

Type: OpenClaw Skill Name: nova-video Version: 1.0.1 The skill provides image and video generation capabilities via the Nova Video API (nova-video.onesolo.app). It contains a shell injection vulnerability in the SKILL.md instructions, where the agent is directed to use curl with unsanitized variables (e.g., $IMAGE_URL and $IMAGE_RESP) derived from previous API responses. This pattern could allow a malicious or compromised API endpoint to execute arbitrary commands on the host system if the response contains shell metacharacters or command substitutions.