Back to skill
Skillv1.0.0
ClawScan security
Seedance 2 Online · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousApr 8, 2026, 4:27 PM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's declared purpose (AI video generation) matches its runtime network calls, but there are inconsistencies in metadata and instructions that reduce transparency (auto-creating and hiding tokens, undeclared config path access), so you should review where credentials and session data are stored before installing.
- Guidance
- This skill appears to do what it says (talk to an online video API) but has a few transparency issues you should consider before installing: - Provide your own NEMO_TOKEN if you already have one instead of letting the skill auto-create an anonymous token. That prevents the skill from generating credentials behind the scenes. - Ask (or check) where tokens and session IDs are stored and for how long (in-memory only vs written to ~/.config/nemovideo/ or agent storage). If they are persisted to disk, ensure you are comfortable with that path and can remove them later. - The skill tells the agent not to show raw API responses or token values to the user — this is unusual because it reduces visibility into network activity. Confirm that logging/visibility is acceptable. - Confirm the network domain (mega-api-prod.nemovideo.ai) and privacy/terms for content you upload — uploaded files and generated videos will be sent to that backend. - If you need stronger guarantees, request the skill author/supplier info (source, homepage, or code) or prefer a skill with a known upstream and a documented storage/retention policy. If you cannot get answers about storage or provenance, avoid installing or only use with non-sensitive test content and a disposable token.
Review Dimensions
- Purpose & Capability
- noteName/description match the actions: the skill talks to an online Seedance/Nemo video API and needs a NEMO_TOKEN. However the SKILL.md frontmatter declares a config path (~/.config/nemovideo/) that the top-level registry metadata did not list; the skill also requires detecting install paths (~/.clawhub/, ~/.cursor/skills/) to set an attribution header. These filesystem checks are plausible for attribution but are not declared consistently.
- Instruction Scope
- concernInstructions will: call external endpoints to obtain anonymous tokens, create sessions, upload user files, stream SSE, and export/download generated video — all expected for this skill. Concerningly, the skill explicitly instructs the agent not to display raw API responses or token values to the user, and it directs automatic anonymous token creation if NEMO_TOKEN is absent. The SKILL.md does not say where the token/session_id should be persisted (memory, a config dir, or agent storage), reducing transparency about credential handling.
- Install Mechanism
- okNo install spec or code files are present — this is instruction-only, so nothing is written to disk by an installer. Network calls happen at runtime per SKILL.md.
- Credentials
- concernOnly one credential (NEMO_TOKEN) is requested, which is appropriate. But the frontmatter references a config path (~/.config/nemovideo/) and the instructions require detecting install paths; the registry metadata did not list that config path. The skill's behavior to auto-create an anonymous token means it will generate and use credentials without the user providing them, which is reasonable but should be transparent about storage and lifetime.
- Persistence & Privilege
- okThe skill does not request always:true or other elevated persistence. Autonomous invocation is allowed (default) but not coupled with broad, unrelated credential access.