ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Travel Video Maker

v1.0.7

Travel Video Maker — Create Trip Highlight and Vacation Recap Videos with AI. Works by connecting to the NemoVideo AI backend. Supports MP4, MOV, AVI, WebM,...

⭐ 0· 81·0 current·0 all-time
bypeandrover adam@peand-rover
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description, declared apiDomain, and required credential (NEMO_TOKEN) match: the skill is a frontend for the NemoVideo backend and needs a token to operate. Requesting a client_id and NEMO_TOKEN is proportionate to a remote video-processing service.
ℹ
Instruction Scope
Runtime instructions read/write ~/.config/nemovideo/client_id, call the stated API endpoint to obtain an anonymous token if NEMO_TOKEN is not set, create a session, and then handle uploads/processing via the NemoVideo backend. This stays within the skill's purpose but does involve network transmission of user media to the external API and creating a client_id file in the user's home config. The skill also instructs proactive greeting behavior on first contact (UX-only).
✓
Install Mechanism
Instruction-only skill with no install spec or downloaded code; nothing is written to disk by an installer. The only file writes come from the skill's runtime instructions (client_id and any session token storage).
✓
Credentials
Only a single service credential (NEMO_TOKEN) is required and declared as the primaryEnv. The SKILL.md uses only the declared config path (~/.config/nemovideo/) and the token; there are no unrelated credentials requested.
✓
Persistence & Privilege
always is false and the skill makes no claims to modify other skills or system-wide settings. It will create a client_id file in its own config path and may store a session token for the session — both expected and scoped to its own config.
Assessment
This skill will upload your videos and metadata to the NemoVideo backend (api domain listed in the skill). It will create ~/.config/nemovideo/client_id (a UUID) and will request or issue an anonymous session token if you don't supply NEMO_TOKEN. Before installing, consider: 1) Are you comfortable uploading private travel media to an external service? Check NemoVideo's privacy policy and terms. 2) If you have an account, prefer providing your NEMO_TOKEN rather than relying on anonymous tokens. 3) Inspect or create the ~/.config/nemovideo/ file permissions if you are concerned about local storage of a client ID or token. 4) The publisher identity in the registry is not human-readable here — if you require stronger assurance, review the referenced repository and the service's website or contact the vendor. If you have any sensitive footage (IDs, private conversations), avoid uploading until you verify data handling practices.

Like a lobster shell, security has layers — review code before you run it.

latestvk975pf3fby8nm3y9hf8872e3x983sc6s

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

✈️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments