ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Ai For Video Generation

v1.0.0

Turn a text prompt describing a product launch scene into 1080p AI-generated videos just by typing what you need. Whether it's generating videos from text pr...

⭐ 0· 41·0 current·0 all-time
by@mhogan2013-9
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
✓
Purpose & Capability
Requires a NEMO_TOKEN and calls a remote 'nemovideo' API to render videos — this aligns with a video-generation skill.
ℹ
Instruction Scope
SKILL.md instructs the agent to obtain/store an anonymous token, create sessions, upload user files, call SSE endpoints, and poll render status — all expected for a cloud render pipeline. However the skill also says it will derive X-Skill-Platform by detecting install paths (e.g. ~/.clawhub/, ~/.cursor/skills/) which implicitly requires reading the user's home filesystem; this filesystem check is not declared elsewhere and broadens the agent's scope.
✓
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest install risk.
ℹ
Credentials
Only NEMO_TOKEN is required (primary credential) which is proportionate for an API-backed video service. Minor inconsistency: SKILL.md frontmatter lists a config path (~/.config/nemovideo/) in its metadata but the registry metadata earlier indicated no required config paths. This mismatch is unexplained.
✓
Persistence & Privilege
always is false and there is no install; the skill will store a session_id/token for API use which is normal for such integrations. Nothing requests elevated or permanent platform-wide privileges.
What to consider before installing
This skill appears to do what it says (call a remote NemoVideo service to generate videos) and only needs a single NEMO_TOKEN. Before installing: (1) confirm the external domain (mega-api-prod.nemovideo.ai) is a trusted service you want to send files to; (2) be aware the skill may inspect your home directory to detect install paths (it derives an X-Skill-Platform header from paths like ~/.clawhub/), so if you prefer avoid that behavior set NEMO_TOKEN yourself and/or run in an environment where the agent cannot read your home directory; (3) avoid uploading sensitive or private media to the service unless you trust its privacy policy; (4) the SKILL.md mentions a config path (~/.config/nemovideo/) in its frontmatter but the registry shows none — ask the author to clarify where session/tokens are persisted. If you need stronger assurance, request the publisher/maintainer identity or an explicit privacy/storage description before use.

Like a lobster shell, security has layers — review code before you run it.

latestvk97adc3172vzj5y7ehsgb7zwh984r4kw

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments