Back to skill
Skillv1.0.0
ClawScan security
Free Caption Generator · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousApr 17, 2026, 3:05 PM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill appears to do what it claims (upload videos to a cloud service and return captioned exports) but there are inconsistencies in its metadata and a few privacy/clarity concerns you should resolve before installing.
- Guidance
- This skill appears to perform cloud captioning as described, but before installing you should: 1) Verify the seller/source and prefer a skill with a homepage or known publisher. 2) Confirm whether the skill will read ~/.config/nemovideo/ (the SKILL.md mentions it but registry metadata does not); if it does, understand what files/credentials it may access. 3) Only provide a NEMO_TOKEN that is specifically for this service (do not reuse AWS, GitHub, or other sensitive tokens). 4) Accept that uploaded videos and audio are sent to mega-api-prod.nemovideo.ai — don’t upload sensitive/private content unless you trust that service. 5) If you need stronger guarantees, ask the publisher for a privacy/ data-retention policy or run uploads from an isolated account/environment. If the publisher cannot clarify the configPath discrepancy or source, treat the skill as higher risk and avoid installing it.
Review Dimensions
- Purpose & Capability
- noteThe skill's name/description (cloud captioning) matches the runtime instructions (upload video, start render, return URL) and the single required credential (NEMO_TOKEN) is appropriate for that backend. However, the SKILL.md frontmatter includes a configPaths entry (~/.config/nemovideo/) while the registry metadata lists no required config paths — this mismatch is unexplained and could indicate the skill may try to read a local config directory that wasn't declared.
- Instruction Scope
- noteInstructions are focused on creating a session, uploading files, and driving exports to a third-party API (mega-api-prod.nemovideo.ai), which is consistent with the stated purpose. It explicitly instructs contacting the API, uploading user video/audio/image files, and streaming SSE responses. That expected network/transmit behavior has privacy implications (private videos get sent to that service). The SKILL.md also tells the agent to hide technical details from the chat and process tool-call results internally — that is reasonable for UX but reduces transparency and should be noted.
- Install Mechanism
- okNo install spec and no code files (instruction-only). This has lower disk-execution risk because nothing is downloaded or executed locally by the skill itself.
- Credentials
- concernOnly NEMO_TOKEN is declared as required, which is proportionate to a hosted captioning service. But the SKILL.md frontmatter also lists a config path (~/.config/nemovideo/) that was not declared in the registry metadata — if the runtime actually reads that path it could access additional credentials or tokens stored there. Also note the skill will send any NEMO_TOKEN present in the environment to the remote API; do not set this to any unrelated secret (e.g., cloud provider or personal account tokens).
- Persistence & Privilege
- okalways is false and the skill does not request persistent/privileged platform-wide settings. It relies on a runtime token and performs network calls; nothing indicates it modifies other skills or system settings.