Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Image To Video Download
v1.0.0convert images into downloadable MP4 video with this skill. Works with JPG, PNG, WEBP, HEIC files up to 200MB. social media creators use it for converting ph...
⭐ 0· 28·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the runtime instructions: the skill calls a remote API to render videos and requires a NEMO_TOKEN. However the SKILL.md frontmatter references a config path (~/.config/nemovideo/) and install-path detection (~/.clawhub/, ~/.cursor/skills/) that are not reflected in the registry's top-level requirements; this mismatch suggests the skill may access filesystem locations not declared in the manifest.
Instruction Scope
Runtime instructions instruct the agent to auto-obtain an anonymous token, create and store a session_id, and to detect the agent's install path by inspecting home-directory paths. It also directs the agent not to display raw API responses or token values to the user. These behaviors involve reading/writing tokens and probing user directories — actions beyond simple 'upload images → get MP4' handling and not fully declared.
Install Mechanism
Instruction-only skill with no install spec and no code files; nothing will be written to disk by an installer. This is the lowest-risk install mechanism.
Credentials
The skill only declares NEMO_TOKEN as the primary credential, which is appropriate for a remote rendering API. However SKILL.md describes auto-generating and storing a token and references config paths in its YAML frontmatter. The manifest-level requirements did not list those config paths. The skill therefore may create or read credentials/config in the user's home directory without that being obvious from the registry metadata.
Persistence & Privilege
always:false and agent invocation is normal. The skill will obtain and reuse an API token and session_id for subsequent requests, which implies some form of ephemeral credential persistence. This is typical for API integrations but the documentation doesn't state where/how session/token are stored or how to revoke them.
Scan Findings in Context
[no_code_files] expected: The regex-based scanner found no code files to analyze — the skill is instruction-only and the security surface is primarily the SKILL.md content.
What to consider before installing
This skill appears to do what it says (remote image→MP4 rendering) but has a few red flags you should consider before installing:
- Confirm whether you trust the backend (https://mega-api-prod.nemovideo.ai). The skill will obtain and use an API token (NEMO_TOKEN) to call that service and may store a session id/token locally. Ask the developer how and where tokens/session IDs are stored and how to revoke them.
- Note the SKILL.md asks the agent to detect install/config paths (~/.clawhub/, ~/.cursor/skills/, ~/.config/nemovideo/). If you don't want an agent probing your home directory, ask the maintainer to remove that behavior or to explicitly request permission at runtime.
- The manifest provided to the registry did not list the config path that appears in the SKILL.md frontmatter—ask for a corrected manifest or clarification.
- Because the skill instructs the agent not to show raw API responses or token values, insist on transparency: you should be able to see what token was created and where it is stored, and you should explicitly consent before any automatic token generation.
If you proceed: only install if you trust nemovideo.ai, request a privacy/security FAQ from the author (storage location, token lifetime, revocation), and consider running the skill in a restricted environment or with a disposable account/token.Like a lobster shell, security has layers — review code before you run it.
latestvk97egh1mqkf57e48srmb9d27kn84ynqs
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎞️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN