Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Speed Ramp Video
v1.0.6Create cinematic speed ramps and velocity edits with AI — snap from normal speed to dramatic slow motion on impact moments, ramp between fast-forward and slo...
⭐ 0· 203·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill is described as a cloud video-editing integration (NemoVideo). Requesting a single NEMO_TOKEN credential is proportionate to that purpose. The SKILL.md also includes an apiDomain (mega-api-prod.nemovideo.ai) and a GitHub repo that are consistent with a remote service. However, the SKILL.md metadata declares a config path (~/.config/nemovideo/) while the registry entry lists no required config paths — this mismatch is unexplained and possibly a packaging error.
Instruction Scope
The SKILL.md content shown is primarily descriptive of features (frame interpolation, beat-sync, moment detection). No explicit instructions to read unrelated system files or invoke other credentials are visible in the excerpt. Because this is an instruction-only skill (no code files), the runtime instructions are the security surface — you should review the full SKILL.md for any explicit directives to read arbitrary paths or to POST files to unexpected endpoints. The included apiDomain matches the stated provider, which is expected.
Install Mechanism
There is no install spec (instruction-only), so nothing is downloaded or installed by the skill itself — this lowers risk and is coherent with the described cloud-API integration.
Credentials
Only NEMO_TOKEN is required and is declared as the primary credential, which is appropriate for a third-party API. The SKILL.md metadata also lists a config path where credentials might be stored (~/.config/nemovideo/); that is reasonable for a client, but the registry's earlier metadata omission of this path is inconsistent and should be clarified. No other secrets or unrelated env vars are requested.
Persistence & Privilege
The skill does not request always:true and does not include any install step that would persist new binaries or modify other skills. Autonomous invocation is allowed (platform default), which is normal for skills. There is no evidence it attempts to change system-wide or other-skill configs.
What to consider before installing
This skill appears to be a straightforward cloud video-editing integration that needs a single API token (NEMO_TOKEN). Before installing, check the following: (1) Inspect the full SKILL.md to confirm it only uploads videos to the stated apiDomain (mega-api-prod.nemovideo.ai) and doesn't read unrelated local files. (2) Note the metadata mismatches: the SKILL.md lists a config path (~/.config/nemovideo/) and a different internal version (10.0.2) than the registry entry (1.0.6). Ask the publisher to explain these differences or provide a matching package. (3) Understand privacy: uploading raw video to a third-party service may expose sensitive content — review NemoVideo's privacy/TOS. (4) Because this is instruction-only (no code to audit), prefer installing only if you trust the provider and are comfortable granting the token and uploading your footage. If you need higher assurance, request a verifiable repository release or a skill with reproducible install artifacts.Like a lobster shell, security has layers — review code before you run it.
latestvk970w91ka82h55p3c2kbsh6bd984aqy0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
⚡ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN