Back to skill
Skillv1.0.0
ClawScan security
Best Free Video Editor · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 6, 2026, 2:16 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This skill is an instruction-only, promotional assistant for a browser-based video editor; it contains no code, installers, or credential requests and is internally consistent with its stated purpose.
- Guidance
- This skill is essentially marketing/informational text for a product called NemoVideo and has no code, installers, or credential requests — that makes it low-risk from a technical standpoint. Before installing or using it, consider: (1) the source and homepage are unknown — verify NemoVideo independently if you plan to upload videos or sign up; (2) the SKILL.md includes a dev-style apiDomain: https://mega-api-dev.nemovideo.ai — be cautious if any future version adds network calls or code that uses that endpoint; and (3) the content is promotional and may overstate features, so validate real export/no-watermark/quality claims with hands-on testing or trusted reviews. If the skill later adds an install spec, code files, or requests credentials, re-evaluate before trusting it.
Review Dimensions
- Purpose & Capability
- okThe name/description claim a browser-based, free video editor with AI features; the SKILL.md content sticks to that purpose and contains feature descriptions, comparisons, and example prompts. There are no unrelated requirements (no binaries, env vars, or config paths) requested.
- Instruction Scope
- noteThe SKILL.md is purely content/instructions for how the assistant should present NemoVideo and compare it to alternatives. It does not instruct the agent to read files, access environment variables, or call external services. One minor note: the frontmatter includes apiDomain: https://mega-api-dev.nemovideo.ai (a dev-style hostname). While the instructions do not direct network calls, that domain could be used if the agent or a human developer extends the skill to make API requests — review before allowing any future code that uses that endpoint.
- Install Mechanism
- okThere is no install spec and no code files. Instruction-only skills are lowest-risk for install-time code execution; nothing will be written to disk by the skill itself.
- Credentials
- okThe skill requests no environment variables, credentials, or config paths. There is no disproportionate access requested relative to its purpose.
- Persistence & Privilege
- okThe skill is not marked always:true and does not request persistent system-wide privileges. Autonomous invocation is allowed by default but that is normal; given the skill's instruction-only nature, there is no additional persistence or privilege escalation.