Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Video Editing Ai Model
v1.0.0edit raw video footage into edited video files with this skill. Works with MP4, MOV, AVI, WebM files up to 500MB. content creators and marketers use it for a...
⭐ 0· 31·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (AI cloud video editing) aligns with the runtime instructions and the API endpoints it uses. Requested primary credential NEMO_TOKEN is sensible for a third‑party video rendering backend. However, the registry metadata lists no required config paths while the SKILL.md frontmatter and metadata mention a config path (~/.config/nemovideo/) — that mismatch is incoherent and worth clarifying.
Instruction Scope
SKILL.md instructs the agent to create sessions, upload user video files, stream SSE, poll render status, and include Authorization and attribution headers on every request — all expected for a cloud render service. Concerns: (1) the skill tells the agent to read its own YAML frontmatter and to detect an install path (~/.clawhub/, ~/.cursor/skills/) on the host filesystem, which requires filesystem access; (2) the registry declares NEMO_TOKEN as required, but the SKILL.md says it can obtain an anonymous token if NEMO_TOKEN is absent, a contradiction. Reading install paths and files is not necessary for basic editing and expands scope.
Install Mechanism
No install spec and no code files (instruction-only). This minimizes on-disk persistence and installation risk.
Credentials
Only NEMO_TOKEN is declared as the primary credential, which is proportional to a cloud API-driven video editor. But SKILL.md will create and use an anonymous token if NEMO_TOKEN is missing — conflicting with the registry's 'required env var' claim. The SKILL.md metadata also references a config path (~/.config/nemovideo/), which was not listed in the registry requirements; that discrepancy should be resolved.
Persistence & Privilege
always:false and no install files; the skill does not request permanent presence or system-wide configuration changes. It does ask the agent to inspect install paths and read its own frontmatter, but it does not ask to modify other skills or system settings.
What to consider before installing
This skill appears to do what it says (upload videos to a third‑party API and return edited files), but check these before installing: 1) Clarify the NEMO_TOKEN requirement — the registry marks it as required, yet the instructions will obtain an anonymous token if absent; decide whether you want uploads authenticated or anonymous. 2) Confirm the backend domain (mega-api-prod.nemovideo.ai) and the service's privacy policy — your raw videos will be sent off‑host. 3) Be aware the skill asks the agent to read install paths and its SKILL.md frontmatter; if you prefer minimizing filesystem reads, ask for a version that avoids that. 4) Prefer using non-sensitive test videos first and, if possible, use an account/token with limited scope or time‑limited credits. If the owner/source remains unknown, consider the privacy risk of uploading personal/raw footage to an unverified backend.Like a lobster shell, security has layers — review code before you run it.
latestvk97c5vj7dss2p5s39yh3refh2s84rb9v
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN