Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Ai Video Generation Free

v1.0.0

Get AI generated videos ready to post, without touching a single slider. Upload your text prompts (MP4, MOV, WebM, AVI, up to 500MB), say something like "gen...

0· 56·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name and description (AI video generation) align with the documented endpoints and the single required credential (NEMO_TOKEN). However, the SKILL.md frontmatter declares a config path (~/.config/nemovideo/) while the registry metadata lists no required config paths — a mismatch that needs explanation.
!
Instruction Scope
Runtime instructions are concrete and limited to interacting with nemovideo.ai (auth, session, upload, SSE, render). But the SKILL.md instructs the agent to detect install platform by inspecting install paths (~/.clawhub/, ~/.cursor/skills/) and derives headers from the SKILL.md frontmatter; both behaviors imply the agent may probe filesystem paths outside the skill's immediate data. Also it instructs persisting session_id and using/setting NEMO_TOKEN — expected for the service, but confirm where/how session tokens are stored.
Install Mechanism
Instruction-only skill with no install spec and no bundled code; this minimizes local disk writes and makes the attack surface primarily network calls to the documented API.
Credentials
Only one credential is declared (NEMO_TOKEN), which is proportionate for a cloud API. But the SKILL.md frontmatter's configPaths (~/.config/nemovideo/) conflicts with registry reporting none, suggesting the skill may access that directory if present. Also platform-detection via install-path probing could reveal agent installation directories, which is not strictly necessary for video generation.
Persistence & Privilege
Skill is not 'always' enabled, has no install hooks, and does not request system-wide privileges. It does require storing session_id and uses tokens for API calls — normal for a client of a cloud service.
What to consider before installing
This skill appears to be a thin client for nemovideo.ai and asks only for NEMO_TOKEN — that's expected — but there are a few things to check before installing: - Provenance: the skill has no homepage and the source is unknown. Prefer packages with a clear owner, website, and docs. Ask the publisher where the service is hosted and verify the domain (mega-api-prod.nemovideo.ai) is legitimate. - Config path mismatch: SKILL.md mentions ~/.config/nemovideo/ while the registry says no config paths. Confirm whether the skill will read or write that directory and what it stores there (session IDs, tokens, logs). - Filesystem probing: the instructions say to detect platform from install paths (~/.clawhub/, ~/.cursor/skills/). If you want to avoid exposing your agent install layout, ask the publisher to remove or justify this behavior. It's not needed to call the video API. - Token handling: NEMO_TOKEN is the only credential requested. If you must set it, prefer a short-lived or scoped token. The skill also documents an anonymous-token flow; you can prefer that to avoid placing a long-lived token in your environment. - Network calls: the skill will make outbound HTTPS requests to the documented API and will send headers derived from the skill metadata. If you have strict data policies, confirm what user content is uploaded and retained. If you decide to proceed, request clearer documentation from the publisher about where session tokens are stored and why the skill needs to detect install paths. If you cannot verify the publisher or behavior, treat this as untrusted and avoid setting a long-lived NEMO_TOKEN in global environment variables.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fp4g94qnrp16p6sy1xbgxnn84pnjy

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments