Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Image To Video Local
v1.0.0Skip the learning curve of professional editing software. Describe what you want — turn my local photos into a 15-second video with smooth transitions — and...
⭐ 0· 38·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The public description emphasizes turning 'local photos into video' and says 'without uploading to cloud editors', but the SKILL.md explicitly routes uploaded files to a cloud rendering pipeline at mega-api-prod.nemovideo.ai. That contradiction (local/no-cloud vs. cloud upload + render) is a core incoherence. Additionally, the registry metadata lists no required config paths, but the skill frontmatter references ~/.config/nemovideo/ — another mismatch.
Instruction Scope
Runtime instructions tell the agent to upload user files (multipart/form-data or URL) to an external API, create sessions, use SSE, and poll render endpoints. They also instruct the agent to auto-acquire an anonymous token if NEMO_TOKEN is not present. These behaviors go beyond purely local processing: they require transmitting potentially sensitive user images to an external service and performing network calls. The SKILL.md also asks the agent to auto-detect an install path to populate an `X-Skill-Platform` header, which implies the agent may inspect environment/paths not strictly required for a simple 'convert local images' operation.
Install Mechanism
There is no install spec and no code files — this is instruction-only and does not write executables to disk. That limits the attack surface from installation.
Credentials
The skill declares a single primary credential (NEMO_TOKEN), which is appropriate for calling a hosted API. However, SKILL.md also describes generating/using an anonymous token via network call when NEMO_TOKEN is absent, and frontmatter lists a config path (~/.config/nemovideo/) that the registry metadata did not. Those inconsistencies reduce clarity about what credentials/config the agent will read or create.
Persistence & Privilege
The skill is not flagged always:true and does not request elevated platform-wide persistence. It can be invoked by the user and can run autonomously (default), which is normal for skills; nothing in the manifest indicates it will modify other skills or persist global agent settings.
What to consider before installing
This skill is internally inconsistent in ways you should understand before using it. Key points to consider before installing or enabling it:
- The marketing claims 'without uploading to cloud editors' but the runtime instructions explicitly upload your images to https://mega-api-prod.nemovideo.ai for cloud rendering. If you expect strictly local processing, do not use this skill.
- The skill will send your files and session data to an external service and will either use an existing NEMO_TOKEN or obtain an anonymous token on your behalf (by POSTing to the provider). If your images contain sensitive or private content, treat this as a cloud upload and avoid using it or test with throwaway images.
- Metadata inconsistencies: the frontmatter references a local config path (~/.config/nemovideo/) that the registry listing did not. Ask the author what that path is used for and whether anything is stored locally.
- No source/homepage is provided. Prefer skills with a verifiable homepage or source repository; request the developer identity and code if you need to audit data handling.
- If you still want to test: use a disposable/anonymous token or the anonymous-token flow, try only non-sensitive images, and monitor network usage. Ask the developer to clarify the 'local vs cloud' discrepancy and to document retention policy for uploaded media and tokens.
Given these mismatches and the privacy implications of uploading local media to an unknown cloud endpoint, treat this skill with caution unless the provider and data handling are verified.Like a lobster shell, security has layers — review code before you run it.
latestvk971q6qrdqv3art8g35cykd88h84shhz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🖼️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN