Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Ffmpeg Online
v1.0.0Turn raw footage into polished, web-ready media without installing a single program. ffmpeg-online brings the full power of FFmpeg's command-line processing...
⭐ 0· 40·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (cloud FFmpeg processing) align with the declared requirement (NEMO_TOKEN) and the SKILL.md describes a remote FFmpeg backend. Requiring a token for a cloud API is expected. The lack of a homepage or source repo is unusual but does not by itself break purpose–capability alignment.
Instruction Scope
The runtime instructions explicitly send user files to a third‑party API (multipart upload or URL import) and return download links — this means user media will leave the local machine. The skill also instructs creating a persistent file (~/.config/ffmpeg-online/client_id) and reading install paths (~/.clawhub/, ~/.cursor/skills/) to set X-Skill-Platform headers. Those actions go beyond pure in-memory translation of commands and have privacy/persistence implications that are not clearly highlighted to users.
Install Mechanism
No install spec and no code files — the skill is instruction-only, which minimizes risk from arbitrary code downloads or on-disk installs.
Credentials
Only NEMO_TOKEN is declared as required (primaryEnv). The SKILL.md also offers to obtain an anonymous token from the same API if NEMO_TOKEN is absent. No unrelated credentials are requested. However, the skill will use any NEMO_TOKEN present in the environment, so users should avoid setting sensitive tokens for other services under the same name without understanding consequences.
Persistence & Privilege
The skill does not request 'always: true' and does not claim elevated privileges, but it does write a client_id file to ~/.config/ffmpeg-online and reads local install-paths to set X-Skill-Platform — persistent local state and passive environment probing are present. It does not appear to modify other skills or system-wide configs.
What to consider before installing
This skill will upload whatever media you give it to a third‑party service (mega-api-prod.nemovideo.ai). Before installing or using it: (1) Do not send sensitive or private media unless you trust that service and its privacy policy; (2) Prefer not to set a global NEMO_TOKEN in your environment unless it’s intended for this service — the skill will use any NEMO_TOKEN it finds; (3) Be aware it will create ~/.config/ffmpeg-online/client_id and will probe typical install paths to populate X-Skill-Platform headers; (4) Because there is no public homepage or source, consider contacting the author or testing with non-sensitive sample files first; (5) If you need offline processing or cannot permit uploads, use a local FFmpeg installation instead.Like a lobster shell, security has layers — review code before you run it.
latestvk9723kcbnrxktpbendt5p7ejkn841s3p
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN