Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Ai Video Sewing Tutorial Maker
v1.0.0Create professional sewing instruction videos for any skill level with AI — generate sewing tutorial content covering machine techniques, pattern drafting, f...
⭐ 0· 65·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to generate sewing instruction videos. The declared primary credential (NEMO_TOKEN) and a config path (~/.config/nemovideo/) are consistent with a third‑party video-generation service, so the requested resources could be legitimate. However, the registry metadata lists no required env vars while the SKILL.md frontmatter names a primaryEnv and configPaths, which is an internal inconsistency.
Instruction Scope
SKILL.md content is an instruction-only specification describing what videos to generate and the pedagogical approach; the provided excerpt does not show commands that read arbitrary files or exfiltrate data. That said, the frontmatter references a config path and a primary token but the instructions do not explain why or how those are used — this gap in the runtime instructions is a scope/clarity issue that could hide credential usage.
Install Mechanism
No install spec and no code files are present (instruction-only). This is the lowest-risk install mechanism because nothing is written to disk by the skill itself.
Credentials
A primary credential named NEMO_TOKEN is declared in SKILL.md frontmatter (and as the skill's primary credential in registry metadata) but required.env is empty in the SKILL.md metadata and registry. This mismatch is suspicious: the skill appears to expect a token but does not consistently declare it. Access to ~/.config/nemovideo/ is requested in the frontmatter, which could grant the skill access to locally stored tokens or config files. While a token for a video service is plausible, the inconsistency and implicit filesystem access are disproportionate without further explanation.
Persistence & Privilege
always is false and there is no install step that modifies system or other skills. The skill does not request persistent platform privileges beyond a possible service token and a config path.
What to consider before installing
This skill is plausible for generating sewing tutorial videos, but there are unexplained inconsistencies you should resolve before installing: 1) Confirm the provenance of the skill (publisher, homepage, and service 'NemoVideo') — the registry entry has no homepage and an unfamiliar owner ID. 2) Ask the publisher to clarify why NEMO_TOKEN is needed, why it’s not listed in required.env, and exactly how the token and ~/.config/nemovideo/ are used (read-only, uploaded, or stored). 3) If you must supply a token, use a least-privilege or scoped test token (not a sensitive production credential). 4) Verify the destination and privacy of generated videos and any uploads (where video data is sent/stored). 5) Prefer skills that clearly declare required env vars and explain runtime calls; avoid providing global credentials or filesystem access until you have those explanations.Like a lobster shell, security has layers — review code before you run it.
latestvk97c81wwksv6c85c5bpa3kebrd83td2c
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
✂️ Clawdis
Primary envNEMO_TOKEN