Back to skill
Skillv1.0.0
ClawScan security
Ai Video Maker From Photo · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 26, 2026, 1:21 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This instruction-only skill is internally consistent with its purpose: it uploads photos to a nemovideo.ai backend using a single NEMO_TOKEN (or an anonymous token it obtains) to render videos; it does not request unrelated credentials or install arbitrary code.
- Guidance
- This skill will send any photos you upload to the nemovideo.ai backend and use a NEMO_TOKEN for authorization. If you set NEMO_TOKEN in your environment, that token will be used; if not, the skill will request a short-lived anonymous token from https://mega-api-prod.nemovideo.ai and use that. Before installing or using the skill: 1) Do not upload sensitive/private images unless you trust the nemovideo.ai service and its privacy terms; 2) Be aware that setting a global NEMO_TOKEN means that token will be used by this skill — only provide a token you intend to share with the service; 3) Note the SKILL.md frontmatter mentions a config path (~/.config/nemovideo/) although the registry metadata did not — this is likely a harmless metadata mismatch but consider verifying expected config/storage behavior; 4) Because this is instruction-only, no code is installed locally, but network activity will occur to the specified API host. If you need more assurance, request the maintainer/source or check the service's privacy policy before uploading private content.
Review Dimensions
- Purpose & Capability
- okName/description (turn photos into MP4s) align with the actions in SKILL.md: uploading images, creating render sessions, polling render status, and downloading a video. The primary credential (NEMO_TOKEN) and the API host (mega-api-prod.nemovideo.ai) are consistent with the described cloud rendering service. Minor inconsistency: the skill's YAML frontmatter lists a config path (~/.config/nemovideo/) while the registry metadata provided to you earlier listed no required config paths — this is likely a metadata mismatch rather than a functional red flag, but it should be noted.
- Instruction Scope
- noteInstructions are concrete and limited to interacting with the remote rendering API (session creation, SSE, upload, export, polls). The runtime will send user images and request/response data to the nemovideo.ai endpoints — expected for this service, but it does mean user files and metadata will leave the local machine. The skill also instructs the agent to look for NEMO_TOKEN and to detect install path for X-Skill-Platform header; it does not instruct reading unrelated system files or other env vars.
- Install Mechanism
- okNo install spec and no code files (instruction-only). This is the lowest-risk install model: nothing is downloaded or written by the skill itself.
- Credentials
- okOnly one credential is requested: NEMO_TOKEN (declared as primaryEnv). That is proportional to a cloud-rendering service. The skill also implements an anonymous-token fallback flow (POST to the service to obtain a short-lived token) which explains why an env var is optional in practice. Note the small metadata mismatch: the SKILL.md frontmatter also declares a config path (~/.config/nemovideo/) not present in the registry's required config paths — likely benign but inconsistent.
- Persistence & Privilege
- okalways is false and the skill is user-invocable; it does not request permanent platform-wide privileges. The skill instructs the agent to store session_id for the session lifecycle, which is reasonable for a rendering workflow.