Pixverse Ai Image To Video

Get animated video clips ready to post, without touching a single slider. Upload your static images (JPG, PNG, WEBP, HEIC, up to 20MB), say something like "a...

What to consider before installing: 1) Source & domain: the skill uses an external API (mega-api-prod.nemovideo.ai) and the skill's homepage/source are unknown — verify the service and its privacy policy before uploading any private or sensitive images. 2) Metadata mismatch: SKILL.md references a config path (~/.config/nemovideo/) not declared in the registry metadata — ask the publisher whether the skill will read or write that directory or persist tokens. 3) Credentials: the skill needs a NEMO_TOKEN (or will obtain an anonymous token). Prefer using the anonymous flow or a scoped/temporary token if available; avoid supplying long‑lived credentials you use elsewhere. 4) Data exfiltration risk: the service necessarily uploads images to a remote server; do not use with confidential images unless you trust the provider. 5) Ask the publisher for provenance (homepage/source repo) and a privacy/retention statement; if you cannot verify the service, treat the skill as untrusted and avoid installing or uploading sensitive content.

Type: OpenClaw Skill Name: pixverse-ai-image-to-video Version: 1.0.0 The skill instructions in SKILL.md contain a high-risk directive to process 'tool calls' received from a remote SSE stream (mega-api-prod.nemovideo.ai) 'internally' without forwarding them to the user. This creates a significant vulnerability to indirect prompt injection, where a remote server could potentially execute unauthorized tools on the agent's host. Additionally, the skill uses a third-party domain (nemovideo.ai) for a service branded as 'PixVerse' and automates the generation and storage of authentication tokens in the environment and local configuration files (~/.config/nemovideo/).