Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Personal Trainer Video
v1.0.4Personal Trainer Video â Create Client Workout and Coaching Videos with AI. Twenty clients on your roster and half of them still text at 10 PM asking "whic...
⭐ 0· 98·0 current·0 all-time
bypeandrover adam@peand-rover
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (AI video editing for personal trainers) matches the runtime instructions: the skill uploads user videos to nemo's API, issues edit/render commands, and returns edited media. However registry metadata claims NEMO_TOKEN is required while the SKILL.md explicitly documents auto-generation of an anonymous token if none is present — this is an internal inconsistency.
Instruction Scope
Instructions are detailed and constrained to the video-editing workflow (SSE edits, upload, render, export). They instruct the agent to read/write ~/.config/nemovideo/client_id and to call the service's anonymous-token endpoint and other API routes. This is within scope for a client, but it does involve persisting a client_id and sending user video files and possibly metadata to an external domain (https://mega-api-prod.nemovideo.ai).
Install Mechanism
No install spec and no code files — instruction-only. No downloads or third-party package installs are requested, which is the lowest install-risk profile.
Credentials
The only declared required credential is NEMO_TOKEN (primaryEnv). That is proportional to contacting the remote editing API. But SKILL.md documents NEMO_TOKEN as optional (auto-generated anonymous token) which conflicts with the registry 'required env' listing. The skill also references and persists a client_id in ~/.config/nemovideo/, which is reasonable for client usage but worth noting because it creates persistent identifiers and may be used to reissue tokens.
Persistence & Privilege
The skill will create/read ~/.config/nemovideo/client_id and persist a UUID if missing; it also asks to keep a session token (NEMO_TOKEN) for up to 7 days. always:false and no cross-skill config writes. Persisting a client id and session token is expected for a service client but it means the skill leaves artifacts in the user's home directory and can be re-used to re-request tokens tied to that client_id.
What to consider before installing
Things to consider before enabling:
- Privacy: this skill uploads your video files and associated metadata to https://mega-api-prod.nemovideo.ai (nemovideo.com). If videos contain sensitive client or patient data, confirm the vendor's privacy/security practices and whether uploads comply with any regulations (e.g., HIPAA).
- Credentials/config: the registry marks NEMO_TOKEN as required, but the SKILL.md shows it can auto-generate an anonymous token and persist a client_id under ~/.config/nemovideo/. Decide whether you prefer to provide your own token (so you control it) or allow the skill to create an anonymous one.
- Persistence: the skill writes ~/.config/nemovideo/client_id (UUID). If you want no persistent identifiers, do not allow this behavior.
- Test first: try with non-sensitive sample videos to confirm edits and outputs before using real client material.
- Verify vendor: the homepage and API domain are declared; if you don't already trust nemovideo.com, review their website, terms, and privacy policy, and consider creating a dedicated account/token with limited scope.
- If you need absolute assurance: avoid auto-generated tokens and instead provision a token you can revoke, and inspect the config folder after first run to confirm what was written.
Overall: functionally coherent for video editing, but the token/config inconsistency and the fact that user media will leave your machine and be processed by an external service justify caution.Like a lobster shell, security has layers — review code before you run it.
latestvk977rq57qb4ccj1ppvdmsfzhkx83qs7y
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
ð Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN