Back to skill
Skillv1.0.0
ClawScan security
Video Generator Meta · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousApr 29, 2026, 4:23 PM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's declared purpose (remote video generation) mostly matches its runtime instructions, but there are inconsistencies and vague behaviors around token/session handling and a hidden config-path requirement that deserve clarification before installing.
- Guidance
- This skill appears to do what it says (upload clips and call a Nemo backend) but has ambiguous behavior around credential/session handling and a mismatched config-path declaration. Before installing: 1) Ask the publisher where NEMO_TOKEN and session_id will be stored (memory only vs file in ~/.config or elsewhere). 2) Ask why the frontmatter mentions ~/.config/nemovideo/ when the registry shows no config paths — if the skill will read or write that folder, you should know what it contains. 3) Confirm privacy: uploaded media will be sent to https://mega-api-prod.nemovideo.ai — make sure you trust that endpoint and its retention policy. 4) If you need stronger guarantees, require ephemeral/anonymous tokens or run the skill in a sandboxed account/environment and do not provide long-lived credentials. If the publisher cannot clarify these points, treat the skill with caution.
Review Dimensions
- Purpose & Capability
- noteThe skill claims to generate videos via the Nemo backend and requires a NEMO_TOKEN — that matches the declared purpose. However, the SKILL.md YAML frontmatter lists a config path (~/.config/nemovideo/) while the registry metadata above the skill said no config paths are required; this mismatch should be clarified.
- Instruction Scope
- concernInstructions tell the agent to automatically obtain an anonymous token (POST to an external API) if NEMO_TOKEN is absent, create and store a session_id, and derive headers including X-Skill-Platform from install paths (e.g., checking ~/.clawhub/ or ~/.cursor/skills/). The SKILL.md is vague about where session/token values are stored (in-memory vs written to disk) and about any filesystem checks — these behaviours could cause persistent secrets on disk or unexpected reads of user paths.
- Install Mechanism
- okNo install spec and no code files are present (instruction-only). That minimizes on-disk installation risk; nothing is downloaded or executed by an install step.
- Credentials
- noteOnly NEMO_TOKEN is declared as required (primary credential), which is coherent for a hosted video-generation service. The possible additional configPath in the frontmatter (~/.config/nemovideo/) is not declared in the registry and could give the skill access to local config data; the SKILL.md also instructs generating and storing anonymous tokens — the justification and storage mechanism for those credentials are not specified.
- Persistence & Privilege
- okalways:false and normal autonomous invocation are used. The skill asks to 'connect automatically' on first open, but it does not request permanent platform-wide privileges or modify other skills. The main persistence question is whether tokens/session IDs are persisted to disk (unspecified).