Back to skill
Skillv1.0.0
ClawScan security
Text To Video Explanation Ai · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 16, 2026, 7:58 PM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's declared purpose (convert text/scripts into MP4 explainer videos) matches its runtime instructions and required credential; nothing appears intentionally misleading, though there are a few minor scope/details to review before use.
- Guidance
- This skill appears to do what it says: it will upload your script/files to a remote API (mega-api-prod.nemovideo.ai) and return rendered video URLs. Before installing or using it: (1) understand that any files or text you submit are sent to an external service — avoid uploading secrets or highly sensitive content; (2) you can provide your own NEMO_TOKEN via environment variable, or the skill will request an anonymous token on your behalf (100 credits, 7-day expiry); (3) the skill instructs detecting an install path and will include an X-Skill-Platform header derived from local paths — this may reveal limited environment information in requests, so consider whether you’re comfortable sending that metadata; (4) check the destination service’s privacy/terms if you have IP or student data concerns. Overall low on technical risk (no install/code), but treat data-sent-to-cloud and the install-path header behavior as the main privacy considerations.
Review Dimensions
- Purpose & Capability
- okName/description match the SKILL.md actions: uploading scripts, creating a session, streaming generation, rendering and returning an MP4. Required env var (NEMO_TOKEN) is appropriate for a remote video-processing API.
- Instruction Scope
- concernOverall instructions are scoped to the video-rendering workflow, but the SKILL.md asks the agent to derive X-Skill-Platform by detecting an install path (e.g., ~/.clawhub/, ~/.cursor/skills/). That implies filesystem probing outside the declared config path (~/.config/nemovideo/) which is not justified by the core conversion task and could expose local environment info in outbound request headers.
- Install Mechanism
- okNo install spec and no code files — instruction-only. This minimizes on-disk installation risk.
- Credentials
- okOnly a single credential (NEMO_TOKEN) is required and is the expected credential for a third-party processing API. The skill also documents creating an anonymous token if no env var is present, which is consistent with needing API access.
- Persistence & Privilege
- okSkill is not always-enabled and does not request elevated/platform-wide privileges. It instructs storing session_id for job management (normal for remote jobs). Autonomous invocation is allowed (platform default) but not unusual here.