Back to skill
Skillv1.0.0
ClawScan security
Jpg To Video · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 28, 2026, 12:24 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requests and runtime instructions match its stated purpose (upload images, call a cloud render API, and return videos); nothing in the manifest is disproportionate or clearly unrelated to image→video conversion.
- Guidance
- This skill appears to do what it says: upload images to a cloud rendering service and return an MP4. Before installing, consider: (1) it requires an API token (NEMO_TOKEN) but will create an anonymous token for you if none is supplied — that token and session_id will be stored (metadata hints at ~/.config/nemovideo/), so verify where/if credentials are saved and how they are protected; (2) your images and any audio you upload are sent to https://mega-api-prod.nemovideo.ai — review the service's privacy policy and retention rules before uploading sensitive content; (3) if you have a paid account, prefer providing your own NEMO_TOKEN rather than using anonymous tokens; (4) confirm the backend domain is legitimate for your use case. If you need higher assurance, ask the skill author where tokens are stored and whether uploads are deleted after processing.
Review Dimensions
- Purpose & Capability
- okName/description (convert still images to videos) aligns with required credential (NEMO_TOKEN) and the SKILL.md which describes uploading images, creating sessions, streaming edits, and requesting exports from a cloud render backend. Requiring an API token for a third‑party rendering service is expected.
- Instruction Scope
- noteSKILL.md confines activity to contacting the nemovideo API, uploading user-supplied files, handling SSE streams, polling job state, and returning download URLs. It does instruct generating or storing an anonymous token and session_id; it does not instruct reading arbitrary local files or unrelated credentials. The doc also says to keep tokens hidden from the user but to store them — where and how they are stored is not specified.
- Install Mechanism
- okInstruction-only skill with no install spec or code files. No binaries or third-party installs are requested, so there is no installation risk.
- Credentials
- noteOnly NEMO_TOKEN is declared as required (primary credential), which is proportional to calling a third‑party API. The SKILL.md also auto‑generates an anonymous token if NEMO_TOKEN is not present. Metadata lists a config path (~/.config/nemovideo/) — the README does not explicitly say it will read/write that path, but the presence of a config path implies the skill may persist tokens/session data locally; the skill does not request other unrelated secrets.
- Persistence & Privilege
- okalways is false and the skill is user‑invocable. Autonomous invocation (model calls) is allowed by default but not combined with other red flags. The skill intends to store a token/session_id (normal for API clients) but does not request system‑wide privileges or modify other skills' configs.