Skillv1.0.0

ClawScan security

Editing Text Generator · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

SuspiciousApr 26, 2026, 4:11 PM

Verdict: suspicious
Confidence: medium
Model: gpt-5-mini
Summary: The skill's stated purpose (generate text overlays by sending video to a cloud renderer) mostly matches its instructions, but there are inconsistencies about required configuration and small privacy/telemetry choices (anonymous-token flow, install-path attribution headers) that warrant caution before installing.
Guidance: What to consider before installing: - This skill sends your video files to an external service (mega-api-prod.nemovideo.ai) for processing. If the content is sensitive, review the service's privacy/security policies or avoid uploading. - The registry claims NEMO_TOKEN is required, but the skill can obtain an anonymous token itself. Decide whether you want to supply your own token (gives potentially longer/paid access) or rely on the anonymous flow (limited credits, 7-day expiry). - The SKILL.md instructs the agent to include attribution headers derived from local install paths. That may reveal information about your local environment; ask the publisher why that telemetry is necessary and whether headers can be minimized. - There is an inconsistency between registry metadata (no config paths) and the SKILL.md frontmatter (lists ~/.config/nemovideo/). Ask the publisher to clarify whether the skill will read or write files in that path and whether tokens are stored to disk. - Because the source and homepage are unknown, consider asking for source code or more provenance (who operates mega-api-prod.nemovideo.ai). Verify the domain and operator before sending private content. - If you decide to proceed, avoid providing unrelated credentials, and test with non-sensitive short clips first. Additional information that would raise confidence to "high": publisher/homepage or source repo, explicit privacy policy for the backend, clarification about whether tokens/config are persisted to disk, and explanation/justification for the install-path attribution headers.

Review Dimensions

Purpose & Capability: noteName/description match the runtime instructions: the SKILL.md documents uploading video, creating a session, running SSE-based generation, and downloading rendered MP4s from a cloud backend. The requested credential NEMO_TOKEN is relevant to the cloud service. No unrelated services or credentials are requested.
Instruction Scope: concernInstructions direct the agent to send user video files to an external API (mega-api-prod.nemovideo.ai), create sessions, upload, poll renders, and stream SSE. They also instruct the agent to generate an anonymous token if NEMO_TOKEN isn't present. The doc asks the agent to derive and send attribution headers that depend on the agent's install path (fingerprinting local install paths) — this could expose local environment information. The overall network/file operations are expected for a cloud render skill, but the install-path attribution and anonymous-token creation behavior are notable and should be explicit to users.
Install Mechanism: okInstruction-only skill with no install spec or code files; no packages or archives are downloaded. Lowest install risk from an installation-mechanism perspective.
Credentials: concernRegistry lists NEMO_TOKEN as a required primary env var, but SKILL.md provides an anonymous-token flow that creates a token automatically if NEMO_TOKEN is absent. Additionally, the SKILL.md frontmatter includes a configPaths entry (~/.config/nemovideo/) while the registry metadata earlier indicated no required config paths — this inconsistency is unexplained. Aside from NEMO_TOKEN, no other secrets are requested.
Persistence & Privilege: okSkill is not always-enabled and does not request system-wide privileges. It uses ephemeral session tokens and render job IDs; nothing in the SKILL.md asks to modify other skills or persist itself permanently.