ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Create Video AI — Generate and Edit Videos from Text Prompts with AI

v1.0.0

Comprehensive AI video generator that creates professional video content from text prompts and scripts through intelligent automation. This skill combines mu...

⭐ 0· 86·0 current·0 all-time
by@nemovideonemo
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
ℹ
Purpose & Capability
The name and description describe an AI text-to-video generator and the SKILL.md explicitly names a NemoVideo backend (mega-api-prod.nemovideo.ai), which is coherent with the skill's purpose. However the registry metadata and SKILL.md provide no vendor/homepage, no maintainer info, and no explanation of required authentication or pricing—missing contextual details reduce trust.
ℹ
Instruction Scope
The SKILL.md is instruction-only and does not instruct the agent to read local files, system config, or extra environment variables. It is vague about how to call the external API (no endpoints, request format, or auth flow), so runtime behavior is underspecified; this vagueness increases risk because the agent or platform may attempt network calls with unclear payloads.
✓
Install Mechanism
No install spec and no code files are present, so nothing will be written to disk by the skill itself. Instruction-only skills have a smaller local attack surface.
!
Credentials
The SKILL.md references an external API but the skill declares no required environment variables or primary credential. Real-world API backends typically require an API key or token; the absence of declared credentials is an inconsistency. This raises questions: will the agent send data unauthenticated, attempt to reuse platform credentials, or require the user to provide secrets later? All are possible but not documented.
✓
Persistence & Privilege
The skill does not request always:true and uses default invocation settings. It does not declare any system-wide config writes. No elevated persistence or automatic always-on behavior is requested.
What to consider before installing
This skill claims to call an external NemoVideo service but provides no vendor info, no homepage, and no authentication details. Before installing, ask the publisher: (1) Who runs mega-api-prod.nemovideo.ai and what is their privacy/data-retention policy? (2) Does the API require an API key or account, and if so, why isn't that declared in requires.env? (3) What exact data is sent (full scripts, user files, metadata)? Avoid sending any sensitive or proprietary content until you verify the service and an auth mechanism. If you proceed, prefer to supply credentials yourself via a clearly named env var and confirm the skill will only send the minimal data needed to generate the video.

Like a lobster shell, security has layers — review code before you run it.

latestvk97d9dnt360rvgphwhvnv23e2583eb2y

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis

Comments