ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Best Video To Text Converter

v1.0.0

content creators, journalists, students convert video files into transcribed text files using this skill. Accepts MP4, MOV, AVI, WebM up to 500MB, renders on...

⭐ 0· 28·0 current·0 all-time
by@siddylcon
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
ℹ
Purpose & Capability
The name/description align with the instructions: the skill uploads video files to a cloud rendering/transcription API and returns transcripts/MP4s. Requiring a single service token (NEMO_TOKEN) is reasonable. However, the SKILL.md frontmatter declares a config path (~/.config/nemovideo/) that is not reflected in the registry metadata, and the skill asks for attribution headers (X-Skill-Source/Version/Platform) which introduces extra behavior not strictly necessary for transcription.
ℹ
Instruction Scope
Runtime instructions stay within the service domain (auth, session creation, upload, SSE, export polling). They explicitly instruct uploading user video files to https://mega-api-prod.nemovideo.ai and creating/using tokens. This is expected for a remote transcription service. Minor scope creep: instructions say X-Skill-Platform is detected from install paths (e.g., ~/.clawhub/, ~/.cursor/skills/) which implies checking filesystem context to set headers—this is not essential to core functionality and may require filesystem probing.
✓
Install Mechanism
No install spec and no code files—instruction-only skill—so nothing is written or downloaded during install. Low install mechanistic risk.
ℹ
Credentials
Only one credential (NEMO_TOKEN) is declared as required and as primary, which matches a remote service integration. Caveat: SKILL.md frontmatter also lists a config path (~/.config/nemovideo/) which suggests the skill expects local config files, but the registry metadata showed no required config paths—this mismatch is inconsistent and should be clarified before trusting the skill with credentials.
✓
Persistence & Privilege
always:false (default) and the skill is user-invocable; the skill can be invoked autonomously by the agent (platform default). The skill does not request elevated or permanent system-wide privileges in its metadata or instructions.
What to consider before installing
This skill appears to be a straightforward remote video-to-text integrator, but exercise caution before using it with sensitive content. Points to consider before installing/using: - The skill sends uploaded videos to an external domain (mega-api-prod.nemovideo.ai). Verify you trust that service and understand its privacy/retention policies before uploading private or sensitive videos. - There is no source code, homepage, or publisher information listed—lack of provenance increases risk. Ask the publisher for a website, privacy policy, or source code before sending real data. - Metadata inconsistency: SKILL.md references a local config path (~/.config/nemovideo/) that the registry did not declare. Confirm whether the skill will read local files or only use the NEMO_TOKEN environment variable. - The skill instructs generation/refresh of anonymous tokens via the service; these tokens grant the service access to uploaded data. Treat tokens as secrets and do not reuse them across unrelated tools. - Test with non-sensitive short videos first to confirm behavior and outputs. If you need higher assurance, request the skill's source or a trusted alternative with documented provenance.

Like a lobster shell, security has layers — review code before you run it.

latestvk973scckhxfr4w6nprcz3x86j184j0em

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎙️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments