Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Video Editing Software
v1.0.0Drop a rough cut or describe your project and get expert guidance on video-editing-software in seconds. Whether you're stuck on color grading in DaVinci Reso...
⭐ 0· 34·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to provide cloud-backed video editing guidance and rendering — requiring a NEMO_TOKEN and talking to mega-api-prod.nemovideo.ai is coherent with that purpose. However, the registry metadata marks NEMO_TOKEN as required while the SKILL.md explicitly generates an anonymous token if NEMO_TOKEN is absent, so the env-var requirement is effectively optional; this mismatch should be clarified.
Instruction Scope
Runtime instructions direct the agent to upload user video files and poll a third‑party render service, which fits the stated purpose. But the SKILL.md also instructs the agent to detect the agent's install path (checking ~/.clawhub/ and ~/.cursor/skills/) to set X-Skill-Platform — those paths are referenced in runtime instructions but are not declared in the skill's configPaths metadata. The skill also says to read its own YAML frontmatter at runtime for attribution headers. Reading system install paths that weren't declared is a scope creep and should be justified.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, which is the lowest-risk install mechanism.
Credentials
Only one environment variable (NEMO_TOKEN) is declared as the primary credential, which is reasonable for a cloud service. However, the SKILL.md will generate and use an anonymous token when NEMO_TOKEN is missing, meaning the declared 'required' env var is not strictly required — an inconsistency. The skill also references a config path (~/.config/nemovideo/) in metadata; reading that directory could be normal for local config but the instructions do not explain what data will be read there.
Persistence & Privilege
The skill does not request always:true and does not declare any elevated or persistent system privileges. Autonomous invocation is enabled by default (normal).
What to consider before installing
This skill appears to do what it claims (cloud-backed video editing guidance and rendering), but review these points before installing:
- Network & privacy: The skill uploads video and project data to mega-api-prod.nemovideo.ai and uses a bearer token (NEMO_TOKEN). That means your video and project metadata will be transmitted to a third party. Don’t upload sensitive footage unless you trust the service and have reviewed its privacy/retention policies.
- Token behavior: The registry marks NEMO_TOKEN as required, but the SKILL.md will request an anonymous token if none is present. Decide whether you want to supply your own token (if you have an account) or allow the skill to obtain a short-lived anonymous token.
- Filesystem access: The runtime instructions ask the agent to detect install paths (~/.clawhub/, ~/.cursor/skills/) and may read its own frontmatter and a config dir (~/.config/nemovideo/). The skill’s metadata declares only ~/.config/nemovideo/ as a config path — if you’re uncomfortable with the agent inspecting other home-directory paths, ask the maintainer to clarify why those checks are needed.
- Attribution headers: The skill requires adding X-Skill-* headers taken from the skill frontmatter and install path. This is normal for attribution but means the agent will read the SKILL.md and local path data to populate headers.
If you plan to use this skill, confirm the trustworthiness of the nemovideo service, avoid uploading confidential footage, and consider supplying your own account token rather than relying on anonymous tokens. If you need higher assurance, ask the publisher to resolve the metadata/instruction mismatches (required env vs. optional token generation, and undeclared install-path reads).Like a lobster shell, security has layers — review code before you run it.
latestvk97fjknzq4f98mjw4a9q28a311842amm
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
