Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Google Ai Video Generator Free
v1.0.0content creators generate text or images into AI generated videos using this skill. Accepts MP4, MOV, JPG, PNG up to 200MB, renders on cloud GPUs at 1080p, a...
⭐ 0· 57·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill is presented as "Google AI Video Generator Free" but all runtime endpoints and the required credential (NEMO_TOKEN) point to mega-api-prod.nemovideo.ai (a Nemo service), not Google. This branding mismatch is misleading and could cause users to expect a Google product when the backend is a third party. Otherwise, required capabilities (NEMO_TOKEN, upload, render endpoints) are coherent with a cloud video-rendering service.
Instruction Scope
SKILL.md instructs the agent to obtain or use a NEMO_TOKEN, create sessions, upload media, use SSE for streaming, and poll render endpoints — all consistent with a remote render service. It also instructs deriving headers from local install path (detecting ~/.clawhub/ or ~/.cursor/skills/) which requires filesystem inspection; this is minor but broader scope than strictly necessary for basic API calls. No instructions request unrelated system files or other credentials.
Install Mechanism
There is no install spec and no code files — this is instruction-only. That is the lowest-install risk profile (no archives or third-party packages are downloaded).
Credentials
The only declared credential is NEMO_TOKEN (primaryEnv), which is appropriate for a Nemo backend. SKILL.md also describes generating an anonymous token if none exists. Metadata lists a config path (~/.config/nemovideo/), meaning the skill may look for local Nemo config; reading that directory could expose pre-existing tokens. No other unrelated secrets are requested.
Persistence & Privilege
always:false and normal autonomous invocation settings. The skill does not request permanent platform-level privileges or modifications to other skills' configs in the instructions.
What to consider before installing
This skill will upload your media to a third-party backend (mega-api-prod.nemovideo.ai) and requires a NEMO_TOKEN. It is not actually a Google service despite the name — treat it as Nemo/Nemovideo. Before installing: (1) confirm you trust nemovideo.ai and are comfortable uploading the files you plan to render (no sensitive data), (2) only provide or allow NEMO_TOKEN if you understand its scope and can revoke it, (3) note the skill may read ~/.config/nemovideo/ and may inspect install paths to set headers, and (4) ask the publisher for a homepage or source repository to verify provenance. If you need a true Google-branded service, do not install this skill.Like a lobster shell, security has layers — review code before you run it.
latestvk97f7pqa2p4zn9f4pqpcc6afgs84kbk9
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN