Back to skill
Skillv1.0.0
ClawScan security
Text To Video For Studying · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 16, 2026, 4:07 PM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's requests and runtime instructions mostly match its stated purpose (sending uploaded notes to a video-rendering backend using a single API token), with a few minor inconsistencies worth noting before you install.
- Guidance
- This skill looks coherent with its stated purpose — it uploads your notes/media to a third-party video-rendering service (mega-api-prod.nemovideo.ai) and requires a service token (NEMO_TOKEN). Before installing, consider: 1) Privacy: any files you upload will be sent to that external service; do not upload sensitive or private data unless you trust the provider and their policies. 2) Tokens: if you don't set NEMO_TOKEN the skill will request an anonymous token automatically — understand what data that anonymous session can access and how long credits/tokens last. 3) Config path: the metadata lists ~/.config/nemovideo/ — ask the publisher what the skill reads/writes there (caching tokens, logs, etc.). 4) Attribution headers: the skill embeds X-Skill-Source/Version in requests; that is expected but means network calls include identifying metadata. 5) Verify the service domain (mega-api-prod.nemovideo.ai) and its privacy/terms before sending course materials. If you can, request from the publisher a brief explanation of why ~/.config/nemovideo/ is required and whether any user files beyond the uploaded notes will be accessed. If the skill later includes code files, installers, or additional required environment variables, re-evaluate — that would increase risk.
Review Dimensions
- Purpose & Capability
- noteName/description align with behavior: the skill talks to a remote video-rendering API and requires a single service token (NEMO_TOKEN). However the registry metadata declares a config path (~/.config/nemovideo/) that is not clearly referenced in the SKILL.md runtime flow — this is plausibly for caching or local config but is not explained.
- Instruction Scope
- noteThe SKILL.md stays within the claimed domain: it instructs uploading user text/files, creating a session, streaming SSE responses, starting renders, and polling state. It also instructs reading the skill's YAML frontmatter (for attribution headers) and checking the agent's install path. The skill will send user content to an external domain (mega-api-prod.nemovideo.ai) and will auto-acquire an anonymous token if NEMO_TOKEN is absent — this is expected but important for privacy.
- Install Mechanism
- okNo install spec and no code files (instruction-only) — lowest-risk installation footprint. Nothing is downloaded or written by an installer.
- Credentials
- noteOnly one credential is declared (NEMO_TOKEN) — appropriate for a single-backend skill. The skill will also obtain an anonymous token from the backend if no token is present (network call). The declared config path (~/.config/nemovideo/) may imply reading or writing local config; the SKILL.md does not justify this, so confirm whether local config access is required and what is stored there.
- Persistence & Privilege
- okalways is false and the skill does not request system-wide changes. It does not ask to modify other skills or global agent settings in the instructions provided.