Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Ai Video Editor Online Free
v1.0.0Tired of paying for bloated video editing software just to cut a clip or add a caption? The ai-video-editor-online-free skill lets you describe exactly what...
⭐ 0· 30·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to perform cloud video editing and requires a NEMO_TOKEN credential — which aligns with calling nemo video APIs. However, the registry metadata (shown to you) lists no config paths while the SKILL.md frontmatter declares a config path (~/.config/nemovideo/) and requires NEMO_TOKEN. Also the SKILL.md contains an anonymous-token flow (it will create a NEMO_TOKEN if none is present), so declaring NEMO_TOKEN as a required env var is inconsistent with the runtime instructions.
Instruction Scope
Instructions are focused on calling a single backend (mega-api-prod.nemovideo.ai) to create sessions, upload videos, stream SSEs and export results — consistent with the stated purpose. The file tells the agent to read its own YAML frontmatter and to probe common install paths (~/.clawhub/, ~/.cursor/skills/) to set X-Skill-Platform headers; reading the skill file/paths is minor but unnecessary for basic editing and slightly increases filesystem access. The skill will upload user video files and session state to the external service — expected for this capability but important from a privacy standpoint.
Install Mechanism
This is instruction-only with no install spec or code to write to disk, which is the lowest install risk. Nothing is downloaded or executed by an installer.
Credentials
Only one credential (NEMO_TOKEN) is involved, which is proportionate for a hosted video service. The concern is the metadata/behavior mismatch: SKILL.md will generate an anonymous token if no NEMO_TOKEN exists, so requiring NEMO_TOKEN up-front is misleading. Also the SKILL.md frontmatter lists a config path that the registry metadata did not; this disparity reduces confidence in the publisher's accuracy.
Persistence & Privilege
always:false and no install steps means the skill does not request persistent, always-on privileges or modify other skills. It does require the agent to send content to an external API (normal for a cloud editor) but does not request system-wide privileges.
What to consider before installing
This skill appears to be a straightforward connector to a third‑party cloud video backend, but note two things before installing: (1) it will upload your video files and session data to https://mega-api-prod.nemovideo.ai — do not use it for sensitive content unless you trust that endpoint and its privacy policy; (2) the registry metadata and the SKILL.md disagree (config path present in SKILL.md; NEMO_TOKEN is declared required even though the instructions create an anonymous token if absent). If you need stronger assurance, ask the publisher for a homepage or source code, verify the nemo API domain and its privacy/security practices, and prefer using your own NEMO_TOKEN rather than relying on an anonymous token flow.Like a lobster shell, security has layers — review code before you run it.
latestvk97384scepypha53h7xgyh0wmx842tvg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN