Runpod Media

Generate images from text, edit images with text instructions, animate images to video, and generate video from text — all via RunPod public AI endpoints. Us...

This skill appears to do what it says (call RunPod and upload local images to Cloudflare R2), but the package metadata, SKILL.md text, and scripts are inconsistent in places. Before installing: 1) Confirm the required credentials (RunPod API key + Cloudflare R2 accessKeyId/secretAccessKey/endpoint/bucket). Provide least-privilege R2 credentials scoped to a temporary bucket if possible. 2) Verify your environment has the 'uv' runtime and the Python dependencies (requests, boto3) or the skill may fail. 3) Note that the skill will read ~/.openclaw/secrets.json and will upload local files to your configured R2 bucket (it creates uploads/ objects and generates presigned GET URLs that RunPod can fetch) — avoid placing highly sensitive images in local paths you plan to upload. 4) Resolve SKILL.md contradictions (imgbb vs R2) and confirm endpoints.json entries before trusting auto-discovery. If you need higher assurance, ask the author to (a) publish consistent metadata declaring required binaries and secrets, (b) reduce the scope of secrets read (only the exact keys), and (c) document dependency installation steps.

Type: OpenClaw Skill Name: runpod-media Version: 1.1.2 The skill contains instructions in SKILL.md that direct the AI agent to bypass the standard OpenClaw messaging framework by manually extracting a Telegram bot token from secrets.json and using curl to send media. This out-of-band communication method bypasses framework-level logging and security controls. Additionally, _utils.py contains logic to read sensitive Cloudflare R2 credentials from secrets.json and upload local files to a remote bucket. While these features support the stated purpose of media generation, the explicit instruction to handle raw credentials and perform direct API calls via shell commands is a high-risk behavior often associated with data exfiltration.