ClawHub

Copywriter Generator

v1.0.0

Skip the learning curve of professional editing software. Describe what you want — generate a 60-second video ad script with voiceover copy for a skincare pr...

⭐ 0· 52·0 current·0 all-time
by@francemichaell-15
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
The skill is a remote copy/video generation wrapper and legitimately requires a service token (NEMO_TOKEN) and network calls to the nemovideo API. Minor packaging inconsistency: the registry metadata reported no required config paths, while the SKILL.md frontmatter lists a config path (~/.config/nemovideo/). This looks like a documentation/metadata mismatch rather than a functional red flag, but it's worth noting.
ℹ
Instruction Scope
SKILL.md confines runtime behavior to authenticating (using NEMO_TOKEN or obtaining an anonymous token), creating a session, uploading media, streaming SSE messages, polling render state, and returning results — all consistent with the described purpose. It does instruct the agent to read the skill's frontmatter and to detect install paths (~/.clawhub/, ~/.cursor/skills/) to set X-Skill-Platform, which implies reading some local paths/metadata; this is reasonable for attribution but is broader than purely network-only behavior.
✓
Install Mechanism
No install spec and no code files — instruction-only skill. This is lower risk because nothing is downloaded or written to disk by an installer.
✓
Credentials
Only NEMO_TOKEN is declared as required and is the primary credential; that matches the service interactions described. The skill also supports obtaining an anonymous temporary token if NEMO_TOKEN is absent. No unrelated credentials or broad environment access are requested.
✓
Persistence & Privilege
always:false and no indication the skill requests persistent system-wide privileges or modifies other skills. Autonomous invocation is allowed (platform default) but is not combined with any unusual privileges here.
Assessment
This skill appears to do what it claims — it talks to a third-party nemovideo API and needs your NEMO_TOKEN (or will obtain a temporary anonymous token) to render videos. Before installing or using it: (1) Confirm you trust the domain (mega-api-prod.nemovideo.ai) and review its privacy/terms because uploaded media (up to 200MB) will be sent to that service. (2) Only supply an API token you control; treat NEMO_TOKEN like a password and rotate/revoke it if unsure. (3) Be aware the skill will add attribution headers (skill source/version/platform) to requests and may read its own frontmatter and detect install paths for that purpose. (4) The metadata mismatch about config paths is likely harmless but verify the skill won't access any other local files you care about. If you need stronger assurances, ask the author for a privacy policy, the exact token scopes, and confirmation they won't persist or share uploaded content outside the service.

Like a lobster shell, security has layers — review code before you run it.

latestvk973rf0d3jtcrx3qgsbtjj57fd84mzhs

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

✍️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments