Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Free Subtitle Maker Online
v1.0.0add video files into captioned video files with this skill. Works with MP4, MOV, AVI, WebM files up to 500MB. YouTubers, content creators, students use it fo...
⭐ 0· 21·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name and description match the runtime instructions: the SKILL.md describes uploading video files to a nemo video backend, creating sessions, and exporting rendered MP4s. Requiring a single service token (NEMO_TOKEN) is proportionate to the stated cloud rendering purpose.
Instruction Scope
Instructions are focused on the nemo backend (auth, session creation, upload, SSE, render). They explicitly instruct uploading user videos and streaming SSE responses — expected for a cloud subtitle/export tool. However the SKILL.md requires that every request include an X-Skill-Platform header auto-detected from the install path, which implies the agent may examine its installation environment or paths; this is not documented in the registry metadata and may broaden file-system access in practice.
Install Mechanism
No install spec or code files are present (instruction-only), so nothing will be written to disk by an installer. This is the lowest install risk.
Credentials
The only declared credential is NEMO_TOKEN, which is appropriate for a cloud API. But SKILL.md also describes obtaining an anonymous token automatically (POST to /api/auth/anonymous-token) if NEMO_TOKEN is missing — acceptable but means the skill will contact an external auth endpoint and treat returned tokens as credentials. Additionally the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) for which the registry metadata earlier reported 'none' — that mismatch suggests the skill may expect to read or write local config (where tokens might be persisted), but this is not clearly declared.
Persistence & Privilege
always:false (normal). The SKILL.md hints at session tokens and a local config path (~/.config/nemovideo/) in its frontmatter; this could be used to persist anonymous or user tokens. The registry-level metadata did not declare required config paths, so it's unclear whether the skill will persist credentials or require filesystem access — this ambiguity increases risk.
What to consider before installing
This skill appears to do what it says (upload your video, generate subtitles in the cloud, return a rendered MP4), but there are a few things to consider before installing/using it:
- Data privacy: Your videos will be uploaded to mega-api-prod.nemovideo.ai. If your content is private/sensitive, do not upload it without verifying the service's terms and retention policy.
- Token handling: The skill uses a single credential NEMO_TOKEN. If none is provided it will request an anonymous token from the service and use it for uploads/exports. Ask whether the skill will persist that token to ~/.config/nemovideo/ or another local path — the SKILL.md mentions that path but the registry metadata does not, which is inconsistent.
- Filesystem access: The skill requires adding an X-Skill-Platform header auto-detected from the install path — this implies the agent may inspect its install environment or paths. Confirm whether that involves reading system paths or only a benign lookup.
- Confirm endpoints: The SKILL.md hardcodes mega-api-prod.nemovideo.ai endpoints. If you don't trust that domain or need on-prem processing, this skill is not suitable.
- Minimizing exposure: If you try it, prefer using an anonymous token (as described) rather than long-lived personal credentials; revoke tokens or clear any stored config after use if you have concerns.
If you want more assurance, ask the skill author to clarify whether the skill writes to ~/.config/nemovideo/, and whether any local files beyond uploaded video blobs are read or stored.Like a lobster shell, security has layers — review code before you run it.
latestvk97382wq57ffkeq7ytqsjjn6ws84p3kj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
💬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN