Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Photo Video Maker Youtube
v1.0.0Cloud-based photo-video-maker-youtube tool that handles turning photo collections into YouTube videos. Upload JPG, PNG, HEIC, WebP files (up to 500MB), descr...
⭐ 0· 63·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to be a cloud photo→video service and its runtime instructions exclusively call nemovideo.ai endpoints for session creation, uploads, SSE, and rendering — that aligns with the description. However, the SKILL.md metadata lists a config path (~/.config/nemovideo/) while the registry metadata earlier lists no required config paths, and the skill declares NEMO_TOKEN as required even though the instructions include an anonymous-token fallback; these are inconsistent.
Instruction Scope
Instructions direct the agent to obtain or use a bearer token, create sessions, upload user files, stream SSE, poll state, and save session_id — all expected for this service. Concerns: (1) the skill instructs generating/using an anonymous token (POST to /api/auth/anonymous-token) and saving it for later use, which means the agent will create and persist credentials; (2) the skill requires certain HTTP headers including X-Skill-Platform derived from the install path (e.g., ~/.clawhub/ or ~/.cursor/skills/), which implies the agent may inspect its install path or filesystem to set that header, potentially leaking local path information; (3) SKILL.md tells the agent not to print tokens but does not specify secure storage location for tokens/session state.
Install Mechanism
No install spec or code is present (instruction-only), so nothing will be downloaded or written by an installer step. Lowest install risk.
Credentials
Only one credential is declared (NEMO_TOKEN), which is appropriate for a cloud media service. But SKILL.md provides a full anonymous-token acquisition flow if NEMO_TOKEN is not set, making the declared 'required' env var unnecessary. Also the demanded attribution headers (X-Skill-Source, X-Skill-Version, X-Skill-Platform) could expose environment/installation path metadata.
Persistence & Privilege
The skill will persist session_id and may persist anonymous tokens for reuse (instructions explicitly say to 'save session_id' and obtain/store tokens). It does not request always: true and does not modify other skills. Persisting tokens/session IDs is functional but raises privacy concerns because stored tokens are credentials with render/upload privileges.
What to consider before installing
This skill appears to implement exactly what it says (cloud photo→video creation), but review these points before you install:
- Trust the service: the runtime talks to https://mega-api-prod.nemovideo.ai; only install if you trust that domain and its privacy policy. Uploaded photos and audio will be sent to that external service.
- Tokens and persistence: the skill either uses a provided NEMO_TOKEN or will call the anonymous-token endpoint to create a token and instructs the agent to save it and session_id. Ask where your agent stores these tokens and whether storage is encrypted; consider providing a dedicated, limited-scope token rather than a broad account token.
- Privacy of local metadata: the skill requires adding X-Skill-Platform derived from install paths (e.g., ~/.clawhub/); this can leak local install paths or environment details. If you are uncomfortable leaking that, decline or request the skill be modified to send a safe static platform value.
- Inconsistencies: the SKILL.md metadata and registry metadata disagree about config paths and the necessity of NEMO_TOKEN. Confirm with the publisher whether NEMO_TOKEN is truly required or optional.
- Sensitive content: do not upload private/identifying images or data you would not want processed by an external cloud service.
If you decide to proceed: prefer providing a limited temporary token, confirm where tokens/session IDs are stored, and monitor network activity for unexpected endpoints. If you want higher assurance, ask the publisher for a privacy/security statement or a code-based skill (so behavior is auditable) rather than an instruction-only skill.Like a lobster shell, security has layers — review code before you run it.
latestvk9753dnjbzeq5s82xwrxxc3n7n84mc3s
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎞️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN