Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Data Format Converter Free
v1.0.0Skip the learning curve of professional editing software. Describe what you want — convert this AVI file to MP4 without losing quality — and get converted MP...
⭐ 0· 17·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description, endpoints, and actions all align with a cloud video-conversion service. However the registry metadata and SKILL.md disagree about whether a config path is required, and the skill declares NEMO_TOKEN as a required env var while the runtime instructions explicitly provide an anonymous-token fallback — these mismatches suggest sloppy or contradictory metadata.
Instruction Scope
Instructions direct uploads of user files to an external API (consistent with purpose) but also instruct deriving an 'X-Skill-Platform' value from local install paths (e.g. ~/.clawhub/, ~/.cursor/skills/), which implies reading local environment/paths. The SKILL.md also tells the agent to 'keep the technical details out of the chat' (i.e. hide some actions). Both behaviors increase risk of unexpected local data access or covert operations and are not fully justified by the conversion task.
Install Mechanism
There is no install spec and no code files; this is instruction-only, so nothing will be written to disk at install time. That reduces install-related risk.
Credentials
The only declared credential is NEMO_TOKEN (reasonable for a third‑party API). But the skill's own instructions allow generating an anonymous token if NEMO_TOKEN is absent, contradicting the 'required env var' claim. The SKILL.md metadata references a config path (~/.config/nemovideo/) not present in registry 'requirements' — this mismatch is unexplained and could imply access to user config files if implemented.
Persistence & Privilege
always:false and no install means the skill does not request permanent presence or system-wide changes. Autonomous invocation is enabled by default (normal). There is no instruction to modify other skills or system settings.
What to consider before installing
What to consider before using/installing:
- The skill uploads your files to https://mega-api-prod.nemovideo.ai. Do not send sensitive videos unless you trust that domain and you understand their retention/privacy policy.
- The registry metadata and SKILL.md contradict each other about whether a local config path or NEMO_TOKEN is required. Ask the author to clarify why NEMO_TOKEN is 'required' when the instructions include an anonymous-token fallback, and whether the skill will ever read ~/.config/nemovideo/ or other local paths.
- The SKILL.md instructs detecting an install path to set X-Skill-Platform — this implies reading the environment or filesystem; request explicit confirmation of what local data the skill will access.
- Because the skill’s source is unknown and there are metadata inconsistencies, test with non-sensitive sample videos first. If you must convert private content, prefer an established tool you control locally.
- If you decide to proceed, limit the token scope, rotate any tokens you provide, and ask the maintainer for a clear privacy/retention statement and a canonical source/homepage for the project.Like a lobster shell, security has layers — review code before you run it.
latestvk9744sdhpmqsqxk4xdx8dwm3r584qndf
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🔄 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN