ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Video Converter Youtube

v1.0.0

Turn a 10-minute AVI lecture recording into 1080p YouTube-ready MP4 just by typing what you need. Whether it's converting video files to YouTube-compatible M...

⭐ 0· 18·0 current·0 all-time
by@imo14reifey
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description match the behavior in SKILL.md: the skill uploads videos and requests a NEMO_TOKEN to use nemoVideo cloud rendering. Required env var (NEMO_TOKEN) and declared config path (~/.config/nemovideo/) are directly related to the described backend service. There are no unrelated credentials or binaries requested.
ℹ
Instruction Scope
Instructions stay within the converter's scope: create/verify a session, upload files, poll renders, and return download URLs. Notable behaviors: (1) if NEMO_TOKEN is absent the skill will call an anonymous-token endpoint and use that token for subsequent requests; (2) it instructs not to display raw API responses or token values; (3) it reads install paths to set an X-Skill-Platform header. These are plausible for attribution and token handling but have privacy implications (uploads and token storage).
✓
Install Mechanism
Instruction-only skill with no install spec or downloaded code — lowest install risk. All runtime actions are HTTP requests to a remote API.
ℹ
Credentials
Only NEMO_TOKEN is required (declared as primaryEnv) which is proportionate for a third-party API. The skill auto-obtains an anonymous token if none is provided; it may persist session_id/token (implied by required config path). This is reasonable but means the skill can obtain and use credentials on the user's behalf for up to the token lifetime.
✓
Persistence & Privilege
always:false and no install-time modifications or cross-skill config writes are described. The skill does not request elevated or persistent platform-wide privileges beyond storing its own session/token data.
Assessment
This skill will upload whatever video files you drop into it to a third-party API (mega-api-prod.nemovideo.ai) and will either use a NEMO_TOKEN you provide or obtain an anonymous token for you (valid ~7 days). Before installing or using it: (1) verify you trust the nemoVideo service and its privacy policy — uploaded videos leave your machine; (2) if you prefer control, provide your own NEMO_TOKEN rather than letting the skill auto-generate one; (3) be aware the skill may store session/token data under ~/.config/nemovideo/ and will probe common install paths for attribution headers; (4) avoid sending sensitive or private videos unless you accept that they will be processed externally. If you need more assurance, ask the author for a homepage, privacy policy, or source code before using.

Like a lobster shell, security has layers — review code before you run it.

latestvk978sn6cjtjd5ynad8dz3xnw0x84n3er

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments