Stump Removal Video — Create Stump Grinding and Stump Removal Marketing Videos for Tree Service and Landscaping Companies
v1.0.0There is a stump in the backyard that has been there for three years. The homeowner tripped on it twice, mowed around it forty-seven times, and told themselv...
⭐ 0· 33·0 current·0 all-time
bypeandrover adam@peand-rover
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill's name/description promise (produce stump-removal marketing videos) matches the runtime instruction which sends a POST to a video-generation API. Requesting a single API token (NEMO_TOKEN) is proportional to that purpose.
Instruction Scope
SKILL.md contains a single curl example that posts company/equipment/service info to an external API with an Authorization header bearing $NEMO_TOKEN. The instructions do not read local files or unrelated env vars. However, SKILL.md metadata references a local config path (~/.config/nemovideo/) that the runtime instructions do not use — an inconsistency to confirm with the publisher.
Install Mechanism
There is no install spec and no code files — this is an instruction-only skill that will not write binaries to disk. That minimizes install-time risk.
Credentials
Only NEMO_TOKEN is required and is the declared primary credential — appropriate for calling nemovideo.ai. Confirm the token's scope/permissions and that it belongs to the expected service account; a token with broader privileges (e.g., other service access) would be disproportionate.
Persistence & Privilege
always is false and there is no request to change other skills or system config. The skill can be invoked autonomously (platform default); combine that with a valid NEMO_TOKEN it could call the external API without interactive approval — expected but worth noting.
Assessment
What to check before installing: 1) Confirm that NEMO_TOKEN is for the nemovideo service you trust and that its permissions are limited to video-generation (don't supply high-privilege or unrelated tokens). 2) Ask the publisher about the metadata inconsistencies: SKILL.md lists a dev apiDomain in front matter but the curl example uses a prod domain, and the front matter mentions ~/.config/nemovideo/ though the instructions never read it — clarify whether the skill will access that path. 3) Be aware that the skill will send the company/service information you provide to an external API (nemovideo.ai). If that data is sensitive, redact or avoid sending it. 4) If you want to limit autonomous calls, review agent settings for skill invocation or only provide a scoped token. If you need more assurance, request the publisher to provide a clear privacy/publishing statement and a stable API endpoint list.Like a lobster shell, security has layers — review code before you run it.
latestvk971sbp0k8z1e992t8wn3qb7qh83z4ym
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🪵 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN