Skillv1.0.0

ClawScan security

Free Video Generator From Photo · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

SuspiciousApr 16, 2026, 5:02 PM

Verdict: suspicious
Confidence: medium
Model: gpt-5-mini
Summary: The skill's declared need for a single NEMO_TOKEN and its API workflow match the photo→video purpose, but the runtime instructions imply persistent storage and filesystem/agent-state access that are not fully reflected in the registry metadata and could surprise users.
Guidance: This skill largely does what it says: it uploads images to nemovideo.ai and returns generated videos and needs an API token (NEMO_TOKEN). Before installing or invoking it, consider: 1) The SKILL.md will create anonymous tokens if NEMO_TOKEN is missing and asks to persist session IDs/tokens — ask where those will be stored (environment vs a file like ~/.config/nemovideo/). 2) The skill will transmit your images to https://mega-api-prod.nemovideo.ai — don't use it for highly sensitive photos unless you trust that endpoint and its privacy policy. 3) Confirm the registry metadata inconsistency (the frontmatter mentions a config path but the package metadata did not); request the author/publisher or a homepage for provenance. 4) If you prefer not to persist credentials, pre-set a disposable NEMO_TOKEN and/or run the skill in an environment that blocks writing to your home config. Because this is an instruction-only skill, there were no code files to scan — absence of scan findings is not proof of safety.

Review Dimensions

Purpose & Capability: noteThe skill is a frontend for the NemoVideo API and legitimately needs an API token (NEMO_TOKEN) and the ability to upload image files. That aligns with the stated purpose. However, SKILL.md frontmatter references a config path (~/.config/nemovideo/) while the registry metadata at the top of the package lists no required config paths — this mismatch is unexplained.
Instruction Scope: concernRuntime instructions direct the agent to obtain an anonymous token if NEMO_TOKEN is absent, create sessions, upload files (multipart/form-data using local paths), open SSE connections, poll render status, and set several attribution headers. These are coherent with the API integration, but the instructions also require the agent to read the install path (for X-Skill-Platform auto-detection) and to 'store the returned session_id' (storage location unspecified). The combination of filesystem reads and persisting tokens/session IDs is broader scope than a simple, transient caller and is not fully specified.
Install Mechanism: okNo install spec or code is present (instruction-only). That minimizes disk-write risk from an installer. Network calls described in SKILL.md are expected for a cloud API integration.
Credentials: noteOnly one environment variable is declared (NEMO_TOKEN) and that is appropriate for an API-backed service. However, SKILL.md instructs generating anonymous tokens automatically and implies storing them (and session IDs). The frontmatter's config path (~/.config/nemovideo/) suggests persistent storage access, but the registry listing did not declare this — a proportionality/visibility gap.
Persistence & Privilege: concernThe skill asks agents to persist session IDs and may store anonymous tokens obtained at runtime. Although always:false (not force-included) and there is no install step, the instructions and frontmatter imply writing to a user config directory. Where/how the token/session will be stored is unspecified, which is a privacy/persistence concern.