ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Video Editor Deutsch

v6.0.1

Video Editor Deutsch - KI Video Bearbeiten, Schneiden und Exportieren. Videos schneiden, zusammenfuegen, Hintergrundmusik hinzufuegen, Farbkorrektur anwenden...

⭐ 0· 171·0 current·0 all-time
by@imo14reifey
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
ℹ
Purpose & Capability
The name/description (German video editor using NemoVideo) matches the runtime instructions: creating sessions, uploading media, editing via the NemoVideo API, and exporting MP4s. However, registry metadata and the SKILL.md disagree about whether NEMO_TOKEN is strictly required: the registry lists NEMO_TOKEN as required while the SKILL.md documents auto-generation of an anonymous token if none is present. Also SKILL.md declares use of ~/.config/nemovideo/ while the top-level registry summary earlier claimed no required config paths — this mismatch is unexpected.
✓
Instruction Scope
SKILL.md directs only to: greet the user, create a session with the NemoVideo API, send messages via SSE, upload files (or URLs) to the API, and report credits/status. The only local filesystem access described is reading/writing ~/.config/nemovideo/client_id and reading user-specified file paths for uploads. All of that is coherent for a remote video-editing skill, but note that user media will be transmitted to nemovideo.ai (the skill explicitly uploads files/URLs).
✓
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest installation risk (nothing is downloaded or executed locally by an installer).
ℹ
Credentials
The primary credential is NEMO_TOKEN which is appropriate for calling an external video-editing API. SKILL.md documents optional env variables (NEMO_API_URL, NEMO_WEB_URL, NEMO_CLIENT_ID) and can auto-generate an anonymous token if NEMO_TOKEN is not set. This conflicts with the registry's claim that NEMO_TOKEN is required; the discrepancy should be clarified. No unrelated credentials are requested.
✓
Persistence & Privilege
always:false (no forced global inclusion). The skill persists a client_id to its own config path (~/.config/nemovideo/client_id) which is reasonable for tracking anonymous sessions. It does not request system-wide configuration or other skills' credentials.
What to consider before installing
This skill uploads videos and audio you provide to nemo's backend (https://mega-api-prod.nemovideo.ai / nemovideo.com). It will create and save a client ID at ~/.config/nemovideo/client_id and either use your NEMO_TOKEN env var or request an anonymous token on first use. Before installing, verify you are comfortable with your media being sent to that external service and check the provider's privacy/terms. Also note a metadata inconsistency: the registry lists NEMO_TOKEN as required but the SKILL.md says it will auto-generate an anonymous token if missing — ask the publisher which behavior is intended, and prefer testing with non-sensitive sample videos first.

Like a lobster shell, security has layers — review code before you run it.

latestvk971tbrehg3fpcmxs20rynpfj583xems

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments