Back to skill
Skillv1.0.0
ClawScan security
Photography Class Video · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousApr 6, 2026, 12:11 AM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill is an instruction-only marketing-video helper that plausibly needs a NemoVideo API token, but the package metadata and runtime instructions disagree about required credentials and there is no provenance (no homepage/owner details) — proceed with caution.
- Guidance
- This skill appears to be what it claims (a marketing/enrollment video helper) and reasonably needs access to a video-service token, but there are two things to verify before installing: 1) metadata mismatch — SKILL.md requires NEMO_TOKEN but the registry summary shows no required env vars; ask the publisher to confirm which credential is required and why, and where the token is sent/used; 2) provenance — there is no homepage or clear source owner listed; confirm the NemoVideo service is legitimate and what scopes the token needs. Operational recommendations: prefer setting NEMO_TOKEN as an environment variable rather than leaving tokens in plaintext at ~/.config/nemovideo/token.txt; if you must create a token, give it the minimal scope and expiration, and rotate/revoke it if you uninstall the skill. If you cannot verify the publisher or the intended NemoVideo endpoint, treat the token as sensitive and do not install.
Review Dimensions
- Purpose & Capability
- noteThe skill's stated purpose (creating enrollment/marketing videos) reasonably justifies needing access to a third-party video service token (NEMO_TOKEN). However the registry summary provided to you lists no required environment variables or primary credential, while the SKILL.md metadata explicitly declares openclaw.requires: ["NEMO_TOKEN"] and openclaw.primaryEnv: NEMO_TOKEN. That mismatch is an inconsistency in the package metadata.
- Instruction Scope
- okSKILL.md is instruction-only: it asks the user to describe the school and gives an example prompt. The only runtime setup instruction is where to store a NemoVideo token (~/.config/nemovideo/token.txt) or to set NEMO_TOKEN. There are no instructions to read unrelated files, harvest other credentials, or send data to unexpected endpoints.
- Install Mechanism
- okThere is no install spec and no code files — this is the lowest-risk install footprint. Because nothing is downloaded or written by an installer, the attack surface is limited to whatever the agent does at runtime following the SKILL.md instructions.
- Credentials
- noteRequesting a single service token (NEMO_TOKEN) is proportionate to a video-generation/integration skill, but the SKILL.md also instructs a concrete config path (~/.config/nemovideo/token.txt). The registry summary given to you did not list any required env vars or config paths, creating ambiguity about what credentials the skill actually needs and how they should be provided. Storing long-lived tokens in plaintext files can be an operational risk; prefer environment variables or scoped short-lived tokens if possible.
- Persistence & Privilege
- okThe skill is not always-enabled and does not request elevated persistence. It is user-invokable and allows normal autonomous invocation (platform default). It does not declare any behavior that modifies other skills or global agent settings.