ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Free Free Video

v1.0.0

Turn a 2-minute smartphone video clip into 1080p free exported videos just by typing what you need. Whether it's editing and exporting videos at no cost with...

⭐ 0· 51·0 current·0 all-time
by@siddylcon
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
ℹ
Purpose & Capability
The name/description (cloud video editing/export) align with the runtime instructions and API endpoints. However, the SKILL.md frontmatter declares a config path (~/.config/nemovideo/) while the registry metadata lists no required config paths — this mismatch is unexplained and worth flagging.
ℹ
Instruction Scope
Instructions stay within the stated purpose (create session, upload video, request renders). They instruct the agent to POST to external endpoints, upload user files, and persist session_id. One small scope creep: header X-Skill-Platform is to be auto-detected from the install path which could require reading agent filesystem paths (not strictly necessary for core functionality). Otherwise the steps are explicit and limited to video processing.
✓
Install Mechanism
No install spec and no code files — instruction-only skill. This is the lowest-risk install model; nothing is written to disk by an installer.
ℹ
Credentials
Only a single env var (NEMO_TOKEN) is required, which is proportional for an API token. The SKILL.md also defines a flow to generate an anonymous token if NEMO_TOKEN is absent. That behavior is plausible, but the skill will accept/handle a token that may be stored or reused — avoid setting a sensitive/shared token as NEMO_TOKEN. The frontmatter/configPath mismatch also raises a minor question about where credentials or session info might be persisted.
✓
Persistence & Privilege
always is false and the skill is instruction-only; it does not request permanent system presence or elevated privileges. It does ask to save a session_id (expected) but does not instruct modifying other skills or global config.
What to consider before installing
This skill looks like a straightforward cloud video-editing frontend, but be cautious before installing or setting credentials: 1) It uploads your videos to an external API (mega-api-prod.nemovideo.ai) — don't upload sensitive footage unless you trust their privacy practices. 2) It asks for a NEMO_TOKEN; if you already have a token, don't reuse tokens that grant access to other services. Prefer creating an anonymous token per this flow rather than setting shared secrets in your environment. 3) The SKILL.md and registry metadata disagree about a config path (~/.config/nemovideo/) — ask the author where session tokens or files are stored and whether anything is written to disk. 4) If you need stronger assurance, request a homepage, author contact, or code/examples of how tokens and session data are stored and revoked. If you do proceed, treat the NEMO_TOKEN as a service-specific secret and avoid using high-privilege credentials.

Like a lobster shell, security has layers — review code before you run it.

latestvk97e4saz4cztvgfxg8qyg1ktqx84nkee

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments