Convert images to videos using Keevx API with support for multiple models, resolutions up to 4K, audio generation, and batch processing.
Security Analysis
medium confidenceThe skill's instructions match an image-to-video converter using an external Keevx API, but the registry metadata omits the required API key and source information is missing — this discrepancy and missing provenance warrant caution.
The SKILL.md describes an image-to-video converter using the Keevx API and the name/description align with that purpose. However, the runtime instructions require an external API key (KEEVX_API_KEY) and specific API endpoints, while the registry metadata lists no required environment variables or primary credential — an inconsistency between claimed requirements and declared metadata.
The instructions are narrowly scoped to uploading images, creating/querying image-to-video tasks, and optionally using callback URLs. They do not instruct reading unrelated system files or additional environment variables. Handling of local files (upload then use returned URL) and use of a callback URL are expected for async processing, but the callback mechanism could be abused if set to an attacker-controlled endpoint.
This is an instruction-only skill with no install spec or code files, so nothing is written to disk or automatically installed. That reduces installer-related risk.
The SKILL.md clearly requires a single API credential (KEEVX_API_KEY) to call the Keevx API, which is proportionate to the described functionality. However, the registry metadata does not declare any required env vars or a primary credential — this mismatch is concerning because it hides the need to provide a secret. The skill otherwise does not request additional unrelated credentials.
The skill is not always-enabled and does not request special agent-wide configuration or persistent system privileges. Autonomous invocation is allowed (platform default) and is not by itself a problem here.
Guidance
Before installing, note that the skill's documentation requires you to provide KEEVX_API_KEY even though the registry metadata omits it — that's an incoherence you should address. Confirm the skill's source and homepage (keevx.com and docs.keevx.com are referenced in the SKILL.md) and verify the domain and API documentation yourself. Only provide an API key with minimal privileges and avoid using sensitive or private images. Be careful with callback_url: if you supply a callback endpoint, ensure it is your controlled, HTTPS endpoint to avoid exfiltration. If possible, ask the publisher to update the registry metadata to declare KEEVX_API_KEY (and provide provenance) before trusting the skill. If you can't verify the publisher, treat it as higher risk and test with throwaway credentials and non-sensitive content first.
Latest Release
v1.0.0
Keevx Image-to-Video Skill 1.0.0 – Initial Release - Enables conversion of images to videos using the Keevx API. - Supports both Model V (general use, single/multi-image, audio, 4K) and Model KL (multi-reference images, up to 7). - Allows various resolutions (720p, 1080p, 4K), adjustable duration, batch generation, and optional audio/narration. - Handles both image URLs and local file uploads with clear API and error handling instructions. - Includes task creation, status querying, robust polling recommendations, and callback notification support. - Provides sample API requests, response formats, and practical usage tips.
Popular Skills
Published by @baidu-xiling on ClawHub
