Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Free Video Generator Chat Gpt
v1.0.0generate text prompts into AI generated videos with this skill. Works with MP4, MOV, WebM, AVI files up to 500MB. content creators use it for generating vide...
⭐ 0· 18·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to convert text prompts into AI-generated videos and its instructions describe upload, SSE streaming, render, and export endpoints that match that purpose. However, registry metadata lists no required config paths while the SKILL.md frontmatter declares a config path (~/.config/nemovideo/), and the skill's source/homepage are unknown — an inconsistency in metadata provenance.
Instruction Scope
Runtime instructions tell the agent to contact an external API (mega-api-prod.nemovideo.ai), obtain or use a NEMO_TOKEN, create sessions, upload user files (multipart @/path or URLs), and detect an install path (~/.clawhub/, ~/.cursor/skills/) to set an X-Skill-Platform header. These are within a video-service scope, but they require network access and reading user-supplied file paths and some local path detection — which has privacy implications. The doc also instructs to 'not display raw API responses or token values' (oddly prescriptive).
Install Mechanism
No install spec or code files are included — the skill is instruction-only, which reduces filesystem risk. However, it will make outbound HTTPS calls to an external API host that is not a well-known vendor; that's an operational/trust consideration rather than an install risk.
Credentials
Only one environment variable is declared (NEMO_TOKEN) which is coherent for an external API. But the instructions say the skill will auto-obtain an anonymous token if NEMO_TOKEN is absent, making the declared required-env somewhat inconsistent with behavior. No other unrelated credentials are requested.
Persistence & Privilege
always is false and the skill does not request permanent platform presence. It does instruct storing a session_id for requests, which is normal for session-based APIs and not an elevated privilege.
What to consider before installing
This skill appears to do what it says (generate/upload/render videos) but you should be cautious before installing because: 1) the backend domain (mega-api-prod.nemovideo.ai) and skill source are unknown — verify the service and its privacy/terms before sending content; 2) the skill will upload your files and session info to that external service, so do not use it with sensitive or private video/audio without checking retention and access controls; 3) metadata is inconsistent (SKILL.md references a config path that the registry metadata does not list and it will auto-create an anonymous token if NEMO_TOKEN is not set) — consider supplying your own token if you want control over the credential, or decline auto-token creation; 4) the skill instructs detecting install paths (reads home-path locations) which is a minor additional filesystem access; if you need higher assurance, ask the publisher for a homepage, privacy policy, and documentation of the API host, or avoid installing until provenance is confirmed.Like a lobster shell, security has layers — review code before you run it.
latestvk97d8856jvkz85cpdgbn88aax984ytdf
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN