ClawHub

Neighborhood Tour Video Maker

v1.0.0

Your listing has professional photos, a virtual tour, and a 3D floor plan — and the buyer relocating from another city is still hesitant because they have no...

⭐ 0· 29·0 current·0 all-time
by@siddylcon
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
ℹ
Purpose & Capability
The skill describes generating neighborhood tour videos and only requests a single API credential (NEMO_TOKEN) which fits that purpose. However, the SKILL.md metadata references a config path (~/.config/nemovideo/) while the registry metadata listed no required config paths — this mismatch should be clarified.
ℹ
Instruction Scope
The runtime instructions show a single POST to https://mega-api-prod.nemovideo.ai/api/v1/generate using NEMO_TOKEN, which matches the described capability. The document is vague about how/where large media files (uploaded footage) are transmitted or stored — the example only sends JSON. That ambiguity gives the agent discretion about file handling and data transfer; the skill does not instruct reading unrelated system files.
✓
Install Mechanism
This is an instruction-only skill with no install steps or code to write to disk, which is the lowest-risk install profile.
ℹ
Credentials
Only NEMO_TOKEN is required (appropriate for an external API). The SKILL.md metadata also listed a config path (~/.config/nemovideo/) that was not reflected in the registry's 'required config paths' field — asking for local config access would broaden privileges and should be justified.
✓
Persistence & Privilege
always:false and normal autonomous invocation settings. The skill does not request permanent system-wide presence or special privileges.
Assessment
This skill appears to do what it says: it calls an external video-generation API and needs a single API token (NEMO_TOKEN). Before installing, verify the API host (mega-api-prod.nemovideo.ai) is the legitimate provider you expect and that the token you provide is limited in scope. Ask the publisher to clarify: (1) whether the skill actually reads or writes ~/.config/nemovideo/ (the SKILL.md metadata mentions it but registry metadata did not), and (2) how large media files are uploaded, stored, and deleted (example curl only shows JSON). Because the skill deals with potentially sensitive video and location data, confirm the vendor's privacy/data-retention policy and test first with non-sensitive footage or a scoped token.

Like a lobster shell, security has layers — review code before you run it.

latestvk979mgt1tcz99xapwytr31hyx5848n0p

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🏘️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments