Back to skill
Skillv1.0.0
ClawScan security
Automatic Jesus Ai · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 26, 2026, 1:23 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requirements and runtime instructions match its stated purpose (calling a remote video-rendering API using a NEMO token); nothing in the files indicates hidden or unrelated access requests, though there is a small metadata inconsistency to verify before use.
- Guidance
- This skill appears to be an instruction-only client for the Nemovideo rendering API and only needs a NEMO_TOKEN to operate. Before installing: 1) Confirm you trust the domain mega-api-prod.nemovideo.ai and the skill publisher (no homepage is provided). 2) Check whether you have a local ~/.config/nemovideo/ file containing credentials — if so, either remove/rotate those secrets or ask the skill author whether the agent will read that path. 3) Prefer giving a limited or ephemeral token (or use the anonymous-token flow) rather than a long-lived high-privilege token. 4) Be cautious about uploading sensitive or private video/audio; review the service’s privacy and retention policies first. If you need clarification (e.g., will the agent read local config files?), ask the author before enabling the skill.
Review Dimensions
- Purpose & Capability
- noteThe skill is an instruction-only wrapper for a remote Nemovideo rendering API and declares a single credential (NEMO_TOKEN) which is consistent with that purpose. Note: the SKILL.md frontmatter metadata references a config path (~/.config/nemovideo/) for the service, whereas the registry metadata lists no required config paths — this mismatch should be clarified (it suggests the skill may try to read a local Nemovideo config if present).
- Instruction Scope
- okRuntime instructions are limited to creating a session, uploading media, streaming edits via SSE, polling export status, and obtaining download URLs from mega-api-prod.nemovideo.ai. The skill explicitly uses NEMO_TOKEN (or requests an anonymous token via a documented endpoint) and instructs not to print tokens. There are no instructions to read unrelated files, harvest extra credentials, or send data to other endpoints.
- Install Mechanism
- okNo install spec and no code files — instruction-only. This is the lowest-risk install profile (nothing is written to disk by the skill itself).
- Credentials
- noteThe skill only requires a single service credential (NEMO_TOKEN), which is proportionate for calling the Nemovideo API. The frontmatter also lists a service config path (~/.config/nemovideo/) which could contain credentials; that may expand the skill's access surface if the agent reads that path. Confirm whether the agent will attempt to read that path and whether that file contains sensitive tokens you don't want exposed.
- Persistence & Privilege
- okalways:false and no install steps. The skill asks the agent to store transient session_id values for ongoing jobs (normal). It does not request persistent system-wide privileges or attempt to modify other skills or global configuration.