Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Ai Video Honeymoon Video
v1.0.0Plan and film the perfect post-wedding romantic getaway with AI — generate honeymoon videos covering destination selection for couples, luxury resort compari...
⭐ 0· 54·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md content is purely travel + filming guidance (planning, shot lists, cinematography tips). However the bundle metadata declares a primary credential (NEMO_TOKEN) and a config path (~/.config/nemovideo/) even though no env vars are listed as required and the instructions do not reference an external API or token. Asking for a token and a config path is not obviously necessary for the described purpose and is an unexplained capability expansion.
Instruction Scope
The SKILL.md itself stays on-topic: destination advice, accommodation reviews, activity and filming guidance. It does not (within the provided excerpt) instruct the agent to read arbitrary system files, shell history, or to send data to external endpoints. No open-ended 'gather whatever context you need' directives were found in the included content.
Install Mechanism
No install spec and no code files — this is an instruction-only skill. That is the lowest-risk install pattern (nothing is downloaded or written to disk by an installer).
Credentials
The manifest declares a primaryEnv (NEMO_TOKEN) and a config path (~/.config/nemovideo/). The SKILL.md does not justify needing credentials or access to a user config directory. Requiring a token could allow access to an external account or upload content; asking for a local config path could allow reading user-specific files. Both requests appear disproportionate given the skill's stated functionality.
Persistence & Privilege
The skill is not always-on and uses default autonomous invocation settings. It does not request system-wide persistence or to modify other skills. No elevated persistence privileges are declared.
What to consider before installing
The skill content itself is travel and filming advice and looks benign, but the metadata asks for a NEMO_TOKEN and points to ~/.config/nemovideo/ without explaining why. Before installing or providing any token: 1) Ask the developer what NEMO_TOKEN is used for and whether the skill can run without it. 2) Refuse to supply credentials unless you trust the service and know the minimum permissions required. 3) If you must test, use a throwaway account or token with limited permissions. 4) Inspect the ~/.config/nemovideo/ files the skill would read (if any) and avoid granting access to other sensitive configs. 5) Prefer using the skill in a sandboxed environment first. These mismatches could be benign (leftover metadata) but should be clarified prior to granting any secrets.Like a lobster shell, security has layers — review code before you run it.
latestvk977wawsmpzrhp8gy1pxbrsw0n83vrp0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
💕 Clawdis
Primary envNEMO_TOKEN