Back to skill
Skillv1.0.0
ClawScan security
Video Openapi Skill · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousApr 28, 2026, 6:39 PM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's requests are mostly coherent with video-processing, but there are inconsistencies and a few scope-creep instructions (reading skill frontmatter / install path, config-path mismatch) that merit caution before installing or granting access to tokens or files.
- Guidance
- This skill appears to do what it says (call a Nemovideo API to process uploaded videos) and only declares a single credential (NEMO_TOKEN), but there are a couple of red flags to consider before installing: 1) The SKILL.md asks the agent to read the skill's YAML frontmatter and to detect an install path to populate X-Skill-Platform — that requires filesystem/installation-context access which may be undesired or unsupported. 2) The SKILL.md metadata references a local config path (~/.config/nemovideo/) while the registry shows none — ask the publisher to clarify why local config paths are needed and exactly what will be read/written. 3) The skill will upload your videos and contact https://mega-api-prod.nemovideo.ai and may create anonymous tokens (100 credits, 7‑day expiry) if you have no NEMO_TOKEN; do not provide production or sensitive credentials unless you trust the service and its privacy/retention policy. Recommended next steps: verify the provider's domain and privacy/security policy, confirm whether the skill actually needs to access local files/install paths (and where session_id / tokens are stored), and avoid using sensitive or private video content until you have clear answers. If the publisher cannot explain the filesystem/access needs, treat the skill as higher risk.
Review Dimensions
- Purpose & Capability
- noteThe skill claims to process video files via the Nemovideo API and only requires a NEMO_TOKEN — that matches the described networked video-processing purpose. However, the SKILL.md metadata mentions a config path (~/.config/nemovideo/) while the registry metadata reported no required config paths, an inconsistency that is unexplained.
- Instruction Scope
- concernInstructions tell the agent to obtain/refresh tokens via POST to https://mega-api-prod.nemovideo.ai and to upload user video files — expected for this use. But the skill also instructs the agent to read this file's YAML frontmatter at runtime and detect install path (~/.clawhub/ or ~/.cursor/skills/) to set X-Skill-Platform. That implies accessing local filesystem/install paths and the SKILL.md file at runtime (scope creep): reading install paths or arbitrary config locations is beyond simply calling a remote video API and may be problematic or impossible depending on the execution environment.
- Install Mechanism
- okThere is no install spec and no code files — this is instruction-only, so nothing new is written to disk by the skill itself. That is the lowest install risk.
- Credentials
- noteOnly NEMO_TOKEN is declared as required (primary credential), which is proportionate for a third-party video-processing API. The SKILL.md also refers to a local config path in its metadata (~/.config/nemovideo/) not declared in the registry summary — another inconsistency to clarify. The skill also implements an anonymous-token flow (POST to the service) which will generate credentials when none are present.
- Persistence & Privilege
- okThe skill is not force-installed (always:false) and does not request elevated platform privileges. It asks to save session_id from the API (normal ephemeral state). Autonomous invocation is allowed by default (platform-level) but the skill does not request persistent platform-wide changes.