pollo-ai-video-generator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pollo-ai-video-generator (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate AI videos by calling the Pollo AI REST API directly.
When the user's request is vague or open-ended (e.g., "make me a video", "I want to try AI video", "generate something cool", no specific model/prompt/parameters), show a brief, friendly guide before asking for details. Do NOT show this guide if the user already has a clear request (e.g., specifies a model, gives a prompt, or provides an image).
Use this template (adapt naturally to match the user's language, keep it concise and professional):
I can help you generate AI videos with Pollo AI.
- **Text to Video**: Create a video from a written prompt
- **Image to Video**: Animate an image into a video
- **Credit Check**: Check your available API credits
I support 13 model brands, including Kling, Sora, Runway, Veo, and Pixverse. If you do not have a preferred model, I can recommend one.
What would you like to create? For example:
- "A cat playing piano in a jazz club, cinematic lighting"
- "Turn this image into a video" (attach an image)
- "Use Kling v2.6 to generate a 10s ocean wave video"Rules for this section:
Store the API key locally in ~/.pollo/config.toml. After setup, do not show it again in later replies.
Important: Do not ask the user to run scripts or commands. All script execution is done by the AI. If setup is needed, ask the user to create a key on the website and paste it into the chat.
Security rule: Never include the API key in any bash command or script argument. Always use the Write tool to create config files containing credentials.
The API key can also be provided via the POLLO_API_KEY environment variable, which takes priority over the config file. If set, skip config file setup entirely.
python3 scripts/pollo_config.pyIf this prints the config summary (from env var or config file), the key is already set up. Skip to Key Validation.
If config is not found (exit code 2 or error), follow this flow:
I need your Pollo API key once before I can generate videos.
>
1. Open https://pollo.ai/api-platform/keys 2. Click Add Key, save it, and paste the key here
>
I will validate it and store it locally so you do not need to paste it again.
Adapt the language to match the user's language. Keep it brief, friendly, and non-technical.
If the user already gave a concrete video request, briefly acknowledge that request before asking for the key.
Write the following content to ~/.pollo/config.toml:
[api]
key = "<the-key-user-pasted>"
base_url = "https://pollo.ai/api/platform" python3 scripts/pollo_api.py GET /credit/balanceNever show the user raw script paths, command-line syntax, or error stack traces.
Before any generation task, validate the key by checking the credit balance:
python3 scripts/pollo_api.py GET /credit/balanceHandle the response:
| Response | Meaning | Action |
|---|---|---|
{ "code": "SUCCESS", "data": { "availableCredits": N, "totalCredits": M } } | Key is valid | Read credits from data. If availableCredits is 0, tell user: "Your available balance is 0 credits. Please top up at https://pollo.ai/api-platform/pricing before generating videos." |
{ "code": "NOT_FOUND" } | Key is invalid or does not exist | Tell user: "That API key does not appear to be valid. Please create a new one at https://pollo.ai/api-platform/keys and paste it here." |
{ "code": "UNAUTHORIZED" } | Key format wrong or missing | Tell user: "The API key format doesn't look right. Keys usually start with pollo_. Please copy it again and paste it here." |
| Exit code 2 | Config not found | Trigger the New setup flow above. Do NOT tell the user to run any commands. |
| Network error / timeout | API unreachable | Tell user: "I couldn't reach the API right now. Please try again in a moment." |
Do NOT proceed to any generation task until the key is validated successfully. This prevents wasted time on tasks that will fail due to invalid keys or zero balance.
The standard flow for any generation task:
GET /credit/balance first (see Key Validation above)"Not enough credits", stop and guide to recharge.poll_task.py synchronously (NOT in background) until completionAll generation endpoints wrap parameters inside an "input" object:
{
"input": {
"prompt": "...",
"aspectRatio": "16:9",
"length": 5
}
}Use pollo_api.py to POST to the model endpoint. Example for Pollo v2.0 text-to-video:
python3 scripts/pollo_api.py POST /generation/pollo/pollo-v2-0 \
--data '{"input":{"prompt":"A cat playing piano in a jazz club","aspectRatio":"16:9","length":5,"resolution":"720p"}}'Response: { "code": "SUCCESS", "data": { "taskId": "xxx", "status": "waiting" } }
Extract taskId from data.
After getting the taskId:
run_in_background:python3 scripts/poll_task.py <taskId> --interval 5 --timeout 300The script reads the API key from ~/.pollo/config.toml automatically. Run it from the skill directory, or otherwise resolve scripts/poll_task.py relative to this skill's root. Set timeout: 300000 on the Bash tool call to allow up to 5 minutes. The script runs silently and outputs a single JSON result to stdout when done.
Before calling any generation or tool endpoint, quickly lock down the minimum required inputs:
prompt, length, aspectRatio, resolution, and audio-related flags only if the chosen model supports themKeep this step brief. The goal is to avoid preventable validation failures, not to interrogate the user when sensible defaults already exist.
When the user has a local image file instead of a URL, upload it first:
python3 scripts/pollo_api.py POST /file/sign \
--data '{"action":"putObject","filename":"photo.jpg","type":"image/jpeg"}'Response includes a signedUrl (for uploading) and a fileUrl (the final HTTPS URL).
python3 scripts/pollo_api.py PUT "<signedUrl>" \
--upload /path/to/photo.jpg --content-type image/jpegimage parameter in the generation request.Below is the quick reference. When the user picks a brand/model, read the corresponding reference file for full parameter details.
| Brand | Models | Reference File |
|---|---|---|
| Pollo | pollo-v1-5, pollo-v1-6, pollo-v2-0 (3 models) | references/brands/pollo.md |
| Kling AI | kling-v1, v1-5, v1-6, v2, v2-1, v2-1-master, v2-5-turbo, v2-6, video-o1 (9 models) | references/brands/kling-ai.md |
| Google Veo | veo2, veo3, veo3-fast, veo3-1, veo3-1-fast (5 models) | references/brands/google.md |
| Sora | sora-2, sora-2-pro (2 models) | references/brands/sora.md |
| Runway | runway-gen-3-turbo, runway-gen-4-turbo (2 models) | references/brands/runway.md |
| Pixverse | pixverse-v3-5, v4, v4-5, v5, v5-5 (5 models) | references/brands/pixverse.md |
| Hailuo | video-01, video-01-live2d, minimax-hailuo-02, minimax-hailuo-2.3, minimax-hailuo-2.3-fast (5 models) | references/brands/minimax.md |
| Pika | pika-v2-1, pika-v2-2 (2 models) | references/brands/pika.md |
| Vidu | vidu-q1, vidu-v1-5, vidu-v2-0, viduq2-pro, viduq2-turbo, viduq3-pro (6 models) | references/brands/vidu.md |
| Luma | luma-ray-1-6, luma-ray-2-0, luma-ray-2-0-flash (3 models) | references/brands/luma.md |
| Wan | wanx-v2-1, wan-v2-2-flash, wan-v2-2-plus, wan-v2-5-preview, wan-v2-6 (5 models) | references/brands/wanx.md |
| Seedance | seedance, seedance-pro, seedance-pro-fast, seedance-1-5-pro (4 models) | references/brands/bytedance.md |
| Hunyuan | hunyuan (1 model) | references/brands/hunyuan.md |
| Function | Details |
|---|---|
| Task Status | GET /generation/{taskId}/status |
| Credit Cost | POST /credit |
| Credit Balance | GET /credit/balance |
| File Upload | POST /file/sign |
For details, read references/common.md.
Default: When the user has no preference, use Pollo v2.0 — good quality, supports audio (generateAudio), up to 10s, up to 1080p, and cost-effective.
When the user has specific needs:
Every API call response must be checked for errors before proceeding. The API returns errors in this format:
{ "message": "Human-readable error", "code": "ERROR_CODE" }| Error Code | Message Pattern | Meaning | What to Do |
|---|---|---|---|
FORBIDDEN | "Not enough credits. Please add more." | Account has insufficient credits | Stop immediately. Tell user: "Your account does not have enough credits. Please top up at https://pollo.ai/api-platform/pricing and try again." |
FORBIDDEN | "PERMISSION_ERROR" | Key lacks permission for this endpoint | Check if the key is valid. If file upload fails with this, the key may not have upload permissions — suggest the user use image URLs directly instead. |
NOT_FOUND | "NOT_FOUND_ERROR" | Invalid API key or wrong endpoint | Tell user: "That API key does not appear to be valid. Please create a new one at https://pollo.ai/api-platform/keys and paste it here." |
UNAUTHORIZED | — | Missing or malformed API key | Tell user: "The API key format doesn't look right. Keys usually start with pollo_. Please copy it again and paste it here." |
BAD_REQUEST | "Input validation failed" | Invalid request parameters | Check the issues array in the response for specific field errors. Fix and retry. |
This is the most common failure. When you see any of these signals:
"Not enough credits"FORBIDDEN after a generation requestavailableCredits: 0Always respond with (adapt to the user's language):
Your Pollo AI account does not have enough credits for this request. Please visit https://pollo.ai/api-platform/pricing to top up, then try again.
Never retry the same request, try a different model, or attempt workarounds when credits are insufficient.
curl commands with API keys. The wrapper reads the key from ~/.pollo/config.toml automatically and adds all required headers (X-API-KEY, Content-Type, User-Agent).~/.pollo/config.toml and do not show it again in later replies.{ "code": "SUCCESS", "message": "success", "data": { ... } }. Always extract the actual payload from the data field.{ "input": { ... } }webhookUrl in the request body/generation/{brand}/{model}Read these as needed (don't load all at once):
Resolve all bundled resources relative to this skill's root. Do not assume any machine-specific absolute path or a particular repo layout.
| File | When to Read |
|---|---|
references/brands/<brand>.md | When generating with a specific brand's model |
references/common.md | For auth, status polling, credits, webhooks, errors |
references/models-index.md | For the full model→endpoint mapping table |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.