Beauty School Video
v1.0.0There are two kinds of people who search for a cosmetology school. The first already knows they want to do hair or skincare — they have been doing it informa...
⭐ 0· 71·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's purpose (create enrollment and marketing video content) matches the single credential it declares in SKILL.md (NEMO_TOKEN) which reasonably could be an API token for a video generation/service provider. However, the top-level registry summary you supplied states 'Required env vars: none' while SKILL.md metadata lists openclaw.requires: ["NEMO_TOKEN"] and openclaw.primaryEnv: NEMO_TOKEN. This mismatch is an administrative/inventory inconsistency that should be corrected but does not by itself indicate malicious behavior.
Instruction Scope
SKILL.md only asks the agent to accept a description of the school and produce video content, and instructs where to find/provide the NemoVideo token (~/.config/nemovideo/token.txt or NEMO_TOKEN env). It does not instruct reading unrelated files, system state, or transmitting data to endpoints other than the implied NemoVideo service. No broad or vague data-gathering steps are present.
Install Mechanism
This is an instruction-only skill with no install specification and no code files. Nothing is downloaded or written by an installer step, so there is no install-time risk.
Credentials
Requiring a single service token (NEMO_TOKEN) is proportionate to a skill that calls an external video service. The SKILL.md suggests storing the token at ~/.config/nemovideo/token.txt or as an environment variable, which is reasonable. The only concern is the earlier registry summary that lists no required env vars — the declared requirement in SKILL.md should be reflected in the registry so users aren't surprised.
Persistence & Privilege
The skill does not request persistent/always-on presence (always:false) and does not ask to modify other skills or system-wide settings. Allowing the agent to call the skill autonomously is the platform default and is not a red flag here.
Assessment
This skill appears to do what it claims: generate marketing/enrollment video content and needs a single service token (NEMO_TOKEN). Before installing, verify the provenance of the NemoVideo service (who runs it and what API the token grants access to), prefer setting the token as an environment variable rather than storing it in plaintext on disk, and correct the registry metadata mismatch so the platform correctly displays that NEMO_TOKEN is required. If you don't recognize 'NemoVideo' or expect a different provider, ask the skill author for clarification and an official API/docs link before providing credentials.Like a lobster shell, security has layers — review code before you run it.
latestvk973tn2tnckg9q9974780ehyqh84afy9
License
MIT-0
Free to use, modify, and redistribute. No attribution required.