Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Text To Video Ai
v1.0.1Tired of spending hours turning scripts, blog posts, or ideas into engaging video content? This text-to-video-ai skill converts your written words into fully...
⭐ 0· 137·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (text→video) lines up with the declared requirement for a single NEMO_TOKEN and the described external rendering API. That credential is proportionate to the stated purpose. However the SKILL.md frontmatter includes a configPaths entry (~/.config/nemovideo/) while the registry listed no required config paths—this mismatch should be resolved (it suggests the skill may read a local config file).
Instruction Scope
Runtime instructions perform network operations against https://mega-api-prod.nemovideo.ai (expected), instruct generation of an anonymous token via an auth endpoint, create/sustain sessions, and upload local files via multipart ('-F "files=@/path"'). The skill also instructs detecting install path to set X-Skill-Platform. Those actions require access to local filesystem and network and may read or send local files and session tokens to the third-party API. The instructions do not describe where session tokens are persisted (env, file) beyond telling the agent to 'save session_id'.
Install Mechanism
This is an instruction-only skill with no install steps and no code to run locally, which minimizes installation risk.
Credentials
The only declared required env var is NEMO_TOKEN (primaryEnv), which fits a single-provider API. The SKILL.md also documents a flow to obtain an anonymous token and instructs use of that token as NEMO_TOKEN. The earlier-mentioned configPaths in the frontmatter is not reflected in the registry's listed required config paths—this inconsistency should be clarified because it implies the skill may read local config files.
Persistence & Privilege
always:false and no install actions are declared. The skill asks to 'save session_id' (typical for API sessions) but does not request elevated platform privileges or permanent always-on status.
What to consider before installing
This skill appears to be a straightforward connector to a third-party text→video service and only needs one API token, but review these before installing: 1) Confirm you trust the domain mega-api-prod.nemovideo.ai and its privacy/terms—the skill will send your text and any uploaded files to that service. 2) Clarify the config-path mismatch: SKILL.md frontmatter references ~/.config/nemovideo/, but the registry lists no config paths—ask the author whether the skill will read local config files. 3) Be cautious about uploading sensitive files or PII: the skill uploads local files to the remote API and generates/stores session tokens. 4) Prefer using a limited-scope or anonymous token (the skill documents an anonymous-token flow) rather than putting a long-lived credential into your environment. If you cannot verify the provider or the config-path behavior, avoid using it with sensitive content.Like a lobster shell, security has layers — review code before you run it.
latestvk97b1k256aathczr4sqw5kd9wh84c2hc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN