Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Professional Development Video — AI Video Maker for Career Growth, Skill Building, and Workforce Development Programs
v1.0.0According to LinkedIn Learning's 2024 Workplace Learning Report, 94% of employees say they would stay at a company longer if it invested in their career deve...
⭐ 0· 37·0 current·0 all-time
bypeandrover adam@peand-rover
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name/description align with generating structured video content for L&D. However the registry metadata declares a primary credential (NEMO_TOKEN) and the SKILL.md metadata references a config path (~/.config/nemovideo/) while the top-level registry reported no required env vars or config paths — this mismatch is unexplained and worth questioning. A video-generation skill might legitimately need a service token, but that relationship isn't documented in the instructions.
Instruction Scope
SKILL.md is instruction-only and asks users to describe role families, objectives, and inputs; it does not instruct the agent to read unrelated files, execute shell commands, or exfiltrate data. The instructions are high-level and do not show how or where any credential would be used.
Install Mechanism
No install spec or code files are present (instruction-only), so nothing will be downloaded or written to disk by an installer. This minimizes install-time risk.
Credentials
A primary credential (NEMO_TOKEN) is declared but requires.env is empty and SKILL.md contains no guidance on that token's purpose, scope, or how it's used. The SKILL.md metadata also lists a config path (~/.config/nemovideo/) that the registry summary said was not required. Requesting a token could be reasonable for a video-generation API, but the lack of documentation about what the token can access, where data is sent, or why local config is needed is disproportionate and ambiguous.
Persistence & Privilege
The skill does not request always:true and is user-invocable; it does not declare system-wide changes or modifications to other skills. No persistent install actions are indicated.
What to consider before installing
Ask the publisher to explain the following before installing: (1) Why is NEMO_TOKEN required? Provide the API/service name, token scope/permissions, and an example of how it's used. (2) Why does the SKILL.md list ~/.config/nemovideo/ as a config path while registry metadata shows none? Does the skill read or write local files? (3) Where are videos and input data uploaded/processed (vendor cloud, user-hosted)? What are retention and access controls? (4) Provide a privacy/security policy, a homepage or source repo, and sample outputs. If you must provide a token, prefer a scoped or revocable token and avoid giving broad credentials until you verify these details.Like a lobster shell, security has layers — review code before you run it.
latestvk973ghv7fdy8yvpawcdzvt8ppx83xjwj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🚀 Clawdis
Primary envNEMO_TOKEN