Skillv1.0.0

ClawScan security

Video To Text Online Free · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

BenignApr 23, 2026, 5:01 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's requirements and runtime instructions are consistent with a cloud-based video→transcript service: it needs a single service token, uploads user videos to a remote API, and has no install-time code — nothing indicates covert behavior, but it will send your videos to an external provider and read a couple of local paths for attribution.
Guidance: This skill uploads user video files to an external API (mega-api-prod.nemovideo.ai) to produce transcripts and rendered MP4s — that is the intended behavior. Before installing, consider: (1) Do you trust this third-party service with the videos you will upload? Avoid uploading sensitive or regulated content unless you confirm their privacy/security policies. (2) The skill will use a NEMO_TOKEN if provided, or obtain an anonymous short-lived token automatically; if you prefer explicit control, provide your own token instead of letting the skill request one. (3) The skill may check a couple of common local install paths for attribution metadata (non-sensitive), which is minor filesystem access. If any of these behaviors are unacceptable, do not install; otherwise the skill appears coherent for its stated purpose.

Review Dimensions

Purpose & Capability: okThe skill is a cloud-backed video transcription/export tool and requests a single NEMO_TOKEN credential and network access to mega-api-prod.nemovideo.ai, which matches the described purpose. One small inconsistency: the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) and platform-detection by install path for attribution, while the registry metadata summary noted no required config paths — this is likely benign but worth noting.
Instruction Scope: noteThe runtime instructions stick to uploading videos, creating sessions, streaming SSE chat, polling for render status, and exporting downloads. They also instruct the agent to read this file's YAML frontmatter and to detect install path patterns (e.g., ~/.clawhub, ~/.cursor/skills/) for X-Skill-Platform attribution. Reading the skill's own frontmatter is expected; probing a couple of standard install paths is minor but does broaden filesystem access beyond pure network I/O. The skill correctly avoids exposing tokens in user-visible output and describes re-auth flows.
Install Mechanism: okThere is no install spec and no code files — the skill is instruction-only, so nothing is downloaded or written to disk by an installer. This is the lowest-risk install pattern.
Credentials: okOnly one credential is declared (NEMO_TOKEN) as the primary credential. The instructions also implement an anonymous-token flow if no token is present (POST to the service to obtain a short-lived token). Requiring a single service token is proportionate for a cloud transcription/export service.
Persistence & Privilege: okThe skill is not always-enabled and makes no requests to modify other skills or system-wide settings. It operates on-demand and uses a session token for operations; no elevated persistence privileges are requested.