Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Text To Video Kling Ai
v1.0.0generate text prompts into AI generated clips with this skill. Works with TXT, PNG, JPG, MP4 files up to 200MB. content creators use it for generating short...
⭐ 0· 16·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill is about generating videos via Kling/Nemovideo and asks for a single credential (NEMO_TOKEN) and calls nemovideo API endpoints — that is coherent. However, the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) while the registry metadata earlier reported no required config paths, creating an inconsistency about whether the skill will access a local config directory.
Instruction Scope
Runtime instructions tell the agent to use NEMO_TOKEN or obtain an anonymous token by POSTing to an external endpoint (expected). But the skill also requires three attribution headers and says X-Skill-Platform should be auto-detected from the install path — this implicitly asks the agent to inspect its install path or filesystem (ambiguous). The SKILL.md also instructs the agent to keep technical details out of chat, which could obscure network activity from users. These points are vague and grant the agent discretionary filesystem/network actions beyond simply calling the service.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest install risk. Nothing will be downloaded or written by an installer as part of the skill package itself.
Credentials
Only one env var (NEMO_TOKEN) is declared which fits the purpose. However, the SKILL.md frontmatter's mention of a config path (~/.config/nemovideo/) is not reflected in registry metadata; if the agent reads that path it could access local stored tokens or other files. The skill also instructs automatic anonymous token acquisition if no token is present, meaning it will call an external auth endpoint and store/use a transient token — reasonable for the service but something to be aware of.
Persistence & Privilege
always:false (no forced permanent presence). The skill creates short-lived sessions with the remote service but does not request elevated platform privileges or modify other skills/configs in the package. No evidence it writes persistent system-wide settings.
Scan Findings in Context
[no_code_files] expected: The skill is instruction-only (SKILL.md only). The regex scanner had no code files to analyze — lack of findings is expected but not a safety guarantee.
What to consider before installing
This skill appears to legitimately call a Nemovideo API and only asks for a NEMO_TOKEN, which is appropriate for video generation. Before installing, verify the backend domain (mega-api-prod.nemovideo.ai) and consider the following: (1) the SKILL.md mentions a local config path (~/.config/nemovideo/) but registry metadata does not — confirm whether the agent will read that directory and what files it might access; (2) the skill may attempt to auto-detect an install path to set X-Skill-Platform, which could require filesystem access — if you are uncomfortable, run the skill in a sandboxed environment or deny filesystem access; (3) anonymous token acquisition is automatic if no NEMO_TOKEN is present — expect outbound network calls to the auth endpoint; (4) because the skill source is unknown and there is no homepage/owner verification, consider only using a disposable or scoped token, or test in an isolated account. If you need higher assurance, ask the author for provenance (homepage, owner contact) and clarification about the config path and what the agent will inspect on your system.Like a lobster shell, security has layers — review code before you run it.
latestvk97cvbf65csbqmycb2fdmk9xxx84ss6z
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN