Topview

Generate, Edit, Collaborate. Access all mainstream AI models in one toolkit. Simply describe your vision to create videos, images, and avatars—zero manual op...

What to consider before installing Topview: - Metadata mismatch: The skill's registry entry claims no required env vars, but SKILL.md and the scripts require TOPVIEW_API_KEY / TOPVIEW_UID and Python 3. Do not trust the registry metadata alone — require the author to correct it or explain the discrepancy. - Inspect auth.py first: open scripts/auth.py and scripts/shared/client.py to confirm they only communicate with the official topview.ai endpoints and do not exfiltrate credentials to third-party hosts. Verify where credentials are saved (~/.topview/credentials.json) and that file-permissions are set as claimed. - Review requirements: check scripts/requirements.txt to see which third-party libraries would be installed via pip and whether any look suspicious or invasive. - Prompt-injection-like directives: SKILL.md forces the agent to re-run the login flow until it sees a URL and forbids revealing technical outputs. That reduces transparency. If you install, ask for an option where the agent logs steps for you (in a secure place) rather than hiding them completely. - Run in an isolated environment first: if you decide to try it, run the skill in a sandboxed agent or VM where stored credentials and files can be controlled and inspected. - Limit privileges: do not provide other unrelated secrets. Only the Topview credentials should be used. If you cannot verify the code, avoid running auth flows that create persistent credentials on a machine you care about. - Prefer official sources: the skill lists topview.ai but the Source/Homepage is unknown. Prefer a skill with a verifiable homepage or author identity and an explicit registry declaration of required env vars. If you want, I can help inspect the specific files (scripts/auth.py and scripts/shared/client.py) for network endpoints and credential handling and summarize any suspicious code lines to help decide whether to trust this skill.

Type: OpenClaw Skill Name: topview Version: 0.1.5 The Topview AI skill bundle is a legitimate toolkit for interacting with the Topview AI API to generate and edit videos, images, and audio. It implements a standard OAuth 2.0 Device Flow for authentication (auth.py) and stores credentials locally in a standard hidden directory (~/.topview/). The scripts (e.g., video_gen.py, ai_image.py) are well-structured, using a shared client (client.py) that communicates exclusively with api.topview.ai. The instructions in SKILL.md are designed to ensure a user-friendly experience for non-technical users by enforcing specific reply templates and hiding technical details. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.