Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Reels Editor
v1.0.0Cloud-based reels-editor tool that handles turning raw footage into shareable Instagram or TikTok Reels. Upload MP4, MOV, AVI, WebM files (up to 500MB), desc...
⭐ 0· 10·0 current·0 all-time
by@udnerc
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the runtime instructions: the SKILL.md describes uploading videos and calling a nemovideo.ai API and the skill requires a single API token (NEMO_TOKEN). However, the registry metadata lists a config path (~/.config/nemovideo/) and platform-detection behavior that aren't strictly necessary to perform the documented API calls, and there is no source/homepage or publisher info to validate the service.
Instruction Scope
Instructions are focused on cloud editing: creating/using a bearer token, creating a session, uploading files, streaming SSE edits, polling export status. These actions are consistent with the described purpose. Minor scope-care items: the SKILL.md requires building HTTP headers that include an X-Skill-Platform value derived from install paths (implies the agent may inspect install/paths), and it instructs generating anonymous tokens and reauth flows — both expected but warrant attention because they involve network calls and persistent tokens. No instructions to read arbitrary system files beyond the implied install/config path checks.
Install Mechanism
No install spec and no code files — instruction-only skill. This is lower risk because nothing will be written to disk by an installer as part of the skill package.
Credentials
Only a single credential (NEMO_TOKEN) is required which is proportional for a cloud API. However, the metadata also declares a config path (~/.config/nemovideo/) and the SKILL.md describes detecting an install path to set X-Skill-Platform. Declaring a config path without clear use is disproportionate for an instruction-only skill and suggests the agent may access user config or filesystem locations — this increases the blast radius for token/cookie discovery if implemented.
Persistence & Privilege
The skill does not request always:true and is user-invocable. It permits autonomous invocation (default) which is normal for skills. The instructions mention saving session_id and using tokens, but do not demand persistent installation or modification of other skills.
What to consider before installing
This skill appears to be what it says—a cloud reels editor that uploads your videos to an external API and needs a NEMO_TOKEN bearer token—but there are a few things to consider before installing or using it:
- Trust and provenance: The package has no source or homepage and an owner ID only; verify the vendor (nemovideo.ai) independently before sending content or putting a long-lived token in your environment.
- Privacy: Using the skill will upload your video files (up to 500MB) to an external domain (mega-api-prod.nemovideo.ai). Do not upload private or sensitive footage unless you trust the service and have confirmed its privacy/retention policy.
- Token handling: The skill uses a bearer token (NEMO_TOKEN). Prefer using a scoped, short-lived, or anonymous token for testing rather than your primary account token. Rotate or revoke tokens you provide to the skill if you stop using it.
- Config/FS access: Metadata references a config path and the SKILL.md describes detecting install paths for header attribution. Ask the publisher how the agent determines X-Skill-Platform and whether any filesystem reads occur; if you are uncomfortable, avoid setting a global NEMO_TOKEN and run in an isolated environment.
- Network visibility: Because the skill makes direct HTTP uploads and SSE connections, consider monitoring network requests during first use and check that requests go only to the documented domain.
If you decide to proceed: test with non-sensitive sample videos and an ephemeral/anonymous token, confirm expected behavior, and only then consider broader use. If you cannot verify the publisher or do not accept uploading content to the listed domain, do not install/use this skill.Like a lobster shell, security has layers — review code before you run it.
latestvk976waercz9tj6j7106vvx59vs84k0fj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
