Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Preschool Marketing Video
v1.0.0As a preschool director, you know the moment. A family walks through your door for a tour — the right family, the kind of family your program is built for —...
⭐ 0· 61·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill is an instruction-only video/content creation assistant for preschools — requiring a token named NEMO_TOKEN and mentioning a nemovideo config path is coherent with a hosted video service. However the declared 'required env vars' is empty while a primaryEnv (NEMO_TOKEN) is present in metadata, which is an internal inconsistency that should be explained.
Instruction Scope
The SKILL.md asks the user to provide program descriptions, classroom footage, teacher profiles, and parent reviews — this is within the expected scope. It also says it “exports” content for website, Google Business Profile, Facebook, Instagram and local networks but does not specify whether it only generates files for manual upload or will perform automated uploads; automated uploads would require additional credentials and explicit instructions (not provided).
Install Mechanism
No install spec and no code files are present (instruction-only skill), so nothing is written to disk or downloaded at install time — this is low risk and consistent with a prose-only helper.
Credentials
A primary credential NEMO_TOKEN is declared but required env list is empty, which is inconsistent. The metadata also lists a config path (~/.config/nemovideo/) — that implies the skill may read or store credentials/config there but the SKILL.md does not explain this. Additionally, the skill references exporting to Google/Facebook/Instagram without declaring any platform credentials, creating ambiguity about what secrets (if any) the skill will request or use.
Persistence & Privilege
always:false and no install or system modifications are requested. The skill is user-invocable and allows model invocation (default), which is normal. There is no indication it attempts to modify other skills or system-wide settings.
What to consider before installing
Before installing or using this skill, ask the developer to clarify three things: (1) Confirm the exact use of NEMO_TOKEN — is it required for the skill to run, and is it stored/loaded from ~/.config/nemovideo/? (2) Does the skill only produce video files for you to upload, or will it automatically post to Google Business/Facebook/Instagram/local networks? If it posts automatically, ask what credentials it will require and how they are stored/transmitted. (3) Request documentation on data handling: where uploaded footage and parent testimonials are stored, who can access them, retention policy, and whether child privacy protections and local regulations (e.g., COPPA or data-protection rules) are addressed. Also: avoid providing sensitive personal data until you confirm how data is protected, and consider testing with non-sensitive sample footage first.Like a lobster shell, security has layers — review code before you run it.
latestvk979rjehyheka07dapmqzxf3px841bbe
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎨 Clawdis
Primary envNEMO_TOKEN