ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Sports Highlight

v1.0.0

sports content creators create raw game footage into condensed highlight reel using this skill. Accepts MP4, MOV, AVI, MKV up to 500MB, renders on cloud GPUs...

⭐ 0· 17·0 current·0 all-time
by@imo14reifey
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description (cloud GPU rendering of highlights) matches the runtime instructions (upload, session creation, SSE, render/export) and the single required credential (NEMO_TOKEN) for the nemo backend.
ℹ
Instruction Scope
Instructions stay within the described purpose (upload video, create render jobs, poll status). They also include a built-in anonymous-token flow (POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token) if NEMO_TOKEN is not present, and automatically create a session and upload files — meaning user data (video files) will be sent to nemovideo.ai unless the user blocks it.
✓
Install Mechanism
No install spec and no code files (instruction-only) — nothing is written to disk by an installer. This is the lowest install risk.
ℹ
Credentials
Only NEMO_TOKEN is required which is proportional to a single external video-rendering service. The SKILL.md frontmatter also lists a config path (~/.config/nemovideo/) which the registry metadata said was not required — this mismatch should be clarified since reading that path could surface existing service credentials or configuration.
✓
Persistence & Privilege
Skill does not request always:true or elevated platform privileges, and does not instruct modifying other skills or global agent settings.
Assessment
This skill will upload your raw video files to an external service (mega-api-prod.nemovideo.ai) and will obtain or use a NEMO_TOKEN for requests — if you don't supply a token it will request an anonymous token automatically. Before installing: (1) confirm you are comfortable sending potentially sensitive footage to that domain and check the service's privacy/terms; (2) if you have an account, prefer providing your own NEMO_TOKEN rather than relying on the anonymous flow; (3) ask the publisher to clarify the configPath behavior (~/.config/nemovideo/) because registry metadata disagrees with SKILL.md; (4) test with non-sensitive short clips first and monitor network requests if you need to audit where data goes.

Like a lobster shell, security has layers — review code before you run it.

latestvk97cfc92yxx5981pddxg1ab0gh84jad9

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🏆 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments