Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Seedance 2 Free
v1.0.0Turn simple text prompts or still images into fluid, cinematic AI-generated videos with seedance-2-free. This skill taps into ByteDance's Seedance 2 free-tie...
⭐ 0· 41·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill name/description (Seedance 2 Free video generation) aligns with the runtime instructions: it calls a remote video generation API and uploads user images/text. Requesting a NEMO_TOKEN is coherent for an API-backed service. Minor inconsistency: the registry summary listed no required config paths while the SKILL.md frontmatter declares a config path (~/.config/nemovideo/). This mismatch is likely clerical but worth noting.
Instruction Scope
SKILL.md instructs the agent to acquire/use NEMO_TOKEN (or obtain an anonymous token via a POST), create sessions, upload files (multipart or URLs), poll status, and download rendered MP4s. These steps are expected for a cloud video service. Note: uploads use local file paths (e.g., -F "files=@/path") — the agent will need access to the user's files only when the user asks to upload; the instructions do not request arbitrary filesystem reads beyond user-provided upload paths. All network calls go to the nemovideo.ai domain; ensure you trust that endpoint before sending tokens or private files.
Install Mechanism
No install spec or code files — instruction-only skill. This minimizes on-disk footprint and installer risk.
Credentials
The skill only requires one credential (NEMO_TOKEN), which is proportionate to the stated purpose. Caveat: SKILL.md also claims a config path in its frontmatter, and the instructions say to 'save session_id' (not explicit where). Confirm where tokens/session state are stored and whether they persist to disk before installing. Otherwise the requested environment access is narrowly scoped.
Persistence & Privilege
always:false (not force-included). The skill may save a session_id/token as part of a session flow, but there is no install-time persistence spec and it does not request system-wide or other-skills' configuration. Autonomous invocation is allowed by default (normal); that combined with a single API token is not itself unusual but you should only grant the token to trusted skills.
Assessment
This skill is an instruction-only wrapper that calls an external Seedance/Nemo video API. Before installing or using it: (1) Verify you trust the domain (mega-api-prod.nemovideo.ai) and the service's privacy policy — any images or text you upload will be sent there. (2) Only provide NEMO_TOKEN if you intend the skill to act on your account; you can let the skill request an anonymous token instead, but that still contacts the external API. (3) Be aware uploads use local file paths — the agent will access files you explicitly ask it to upload. (4) Ask the skill author where session data/tokens are stored (in-memory vs. written to ~/.config/nemovideo/) if you care about local persistence. Because this is instruction-only with no code to audit, proceed only if you trust the remote service and are comfortable with the data you send it.Like a lobster shell, security has layers — review code before you run it.
latestvk972h4dx81d94qq79976dshynh84ed0q
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN