ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Ai Text To Video Generator

v1.2.1

The ai-text-to-video-generator skill on ClawHub transforms written prompts into fully rendered video content through a conversational interface. Describe you...

⭐ 0· 142·0 current·0 all-time
bypeandrover adam@peand-rover
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The skill declares a primary credential (NEMO_TOKEN) and a nemovideo config path; those map directly to a hosted video generation service. There are no unrelated credentials, binaries, or config paths requested.
✓
Instruction Scope
SKILL.md instructs the agent to greet users proactively, obtain or read a Client-ID at ~/.config/nemovideo/client_id, call the nemovideo anonymous-token endpoint via curl, and create a session. These actions are within scope for a cloud API-backed video generator. The skill does write a client_id file and performs network requests to the stated API domain.
✓
Install Mechanism
There is no install spec or code to run on install (instruction-only), so nothing arbitrary is downloaded or written beyond the documented client_id persistence at runtime.
✓
Credentials
Requested environment variables are limited to service-related items (NEMO_TOKEN, NEMO_API_URL, NEMO_WEB_URL, NEMO_CLIENT_ID). The NEMO_TOKEN credential is appropriate for accessing the remote API; the only on-disk write is a UUID client_id (non-secret).
✓
Persistence & Privilege
always is false. The only persistent change is writing ~/.config/nemovideo/client_id (UUID only). The skill does not request system‑wide configuration changes or access to other skills' credentials.
Assessment
This skill will contact nemovideo.com (or the configured NEMO_API_URL) and will persist a small non‑secret client_id at ~/.config/nemovideo/client_id. It will obtain or use a NEMO_TOKEN to call the API (anonymous tokens expire in 7 days). Before installing: 1) Confirm you trust nemovideo.com and the referenced API endpoints, 2) Avoid uploading sensitive/private media unless you accept the service's handling and retention policies, 3) Be aware the skill will perform outbound network calls and may use credits tied to the token, and 4) If you prefer, create a dedicated/toxic‑content‑free account or token on the service you can revoke later. There is no install script to audit (instruction-only), so review the service's privacy/terms and the skill's repository (if you need more assurance) before use.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fw95d2nd4gw6769dxpksgtn83xvrb

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
Primary envNEMO_TOKEN

Comments