Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Deutsch Editor Ai
v1.0.0German-speaking content creators edit raw video footage into edited German videos using this skill. Accepts MP4, MOV, AVI, WebM up to 500MB, renders on cloud...
⭐ 0· 55·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to do German-language cloud video editing and its instructions call a video-rendering backend (upload, session, render, export endpoints). Requiring a NEMO_TOKEN is proportionate to a cloud service integration. However the SKILL.md metadata lists a config path (~/.config/nemovideo/) while the registry metadata reported none — this mismatch should be clarified.
Instruction Scope
Runtime instructions are explicit about uploading files, creating sessions, sending SSE, polling render status, and returning download URLs — all expected for a cloud editor. The skill also instructs the agent to detect install path (~/.clawhub, ~/.cursor/skills/) and read the SKILL.md frontmatter to set attribution headers; reading user home paths and config locations is outside the core edit/upload flow and is scope creep that the user should be aware of.
Install Mechanism
Instruction-only skill with no install spec or code files — nothing will be written to disk by an installer from this package itself. This lowers install risk.
Credentials
Only NEMO_TOKEN is declared as required, which fits a cloud API. But the instructions permit the agent to automatically obtain an anonymous NEMO_TOKEN by POSTing to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token and then use it as the primary credential. That behavior effectively creates and uses credentials on the user's behalf (and associates a generated client UUID). If you expect to provide your own token, confirm this behavior; if you do not want the skill to mint/use anonymous tokens or communicate with that domain, do not install. Also note the SKILL.md requests reading local config/install paths not declared in registry metadata.
Persistence & Privilege
always:false and no install-time persistence are used. The skill keeps session_id in memory for the session, but does not request platform-wide privileges or modify other skills. Autonomous invocation is allowed (default) but not combined with excessive declared privileges.
What to consider before installing
This skill appears to implement a legitimate German video-editing integration that uploads your videos to nemo's cloud backend. Before installing, consider: (1) Origin: the skill has no homepage or source link — verify the vendor (nemovideo) and the domain mega-api-prod.nemovideo.ai independently. (2) Privacy: your videos will be uploaded to an external service; avoid sending sensitive content unless you trust the service and its retention/privacy policy. (3) Tokens: the skill will accept an existing NEMO_TOKEN or automatically request an anonymous token (it will generate a UUID and call the backend). If you prefer full control, supply your own token or decline anonymous provisioning. (4) Local reads: the skill may check common install/config paths and the skill file frontmatter for attribution — if you are uncomfortable with any filesystem probing, ask for that behavior to be removed. (5) Clarify the metadata mismatch (registry says no config paths, SKILL.md includes ~/.config/nemovideo/). If you need higher assurance, request a verifiable source/repo or vendor documentation before use.Like a lobster shell, security has layers — review code before you run it.
latestvk97ech4bksz728w639egseec2984k1k4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🇩🇪 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN