Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Yoga Studio Video

v1.0.5

A new student is searching for a yoga class at 11pm on a Tuesday. She has been meaning to start for eight months. She has the tab open for three studios in h...

0· 171·0 current·0 all-time
bypeandrover adam@peand-rover

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for peand-rover/yoga-studio-video.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Yoga Studio Video" (peand-rover/yoga-studio-video) from ClawHub.
Skill page: https://clawhub.ai/peand-rover/yoga-studio-video
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install yoga-studio-video

ClawHub CLI

Package manager switcher

npx clawhub@latest install yoga-studio-video
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's stated purpose (generating promotional yoga videos) reasonably requires an API token for an external video service (NemoVideo/NEMO_TOKEN). That capability aligns with the description. However, the registry summary provided with the skill claims no required environment variables or config paths while the SKILL.md metadata declares openclaw.requires: ["NEMO_TOKEN"] and primaryEnv: NEMO_TOKEN — a metadata mismatch.
Instruction Scope
SKILL.md instructs the user to store the NemoVideo token at ~/.config/nemovideo/token.txt or set NEMO_TOKEN. The runtime instructions themselves are scoped to describing the studio and sending it to the video generator; they do not instruct the agent to read unrelated system files. The explicit filesystem path in the setup is a legitimate place to store a credential, but that config path was not declared in the registry metadata.
Install Mechanism
No install spec and no code files are present (instruction-only). This minimizes on-disk execution risk because nothing is downloaded or installed by the skill.
!
Credentials
The SKILL.md requires one credential (NEMO_TOKEN), which is proportionate for a video-generation integration. The concern is the inconsistency: the registry reported 'Required env vars: none' and 'Required config paths: none' while the SKILL.md both declares NEMO_TOKEN and directs storing a token at ~/.config/nemovideo/token.txt. That mismatch can hide where the agent will look for secrets and how the token is used/transmitted. Also note the token would be stored in plaintext at a user dotfile unless the user secures it differently.
Persistence & Privilege
The skill is not always-enabled and is user-invocable; it does not request elevated platform privileges and there is no install step that modifies other skills or system-wide settings.
What to consider before installing
Before installing: (1) Ask the skill author to resolve the metadata mismatch — confirm whether NEMO_TOKEN is required and whether the skill will read ~/.config/nemovideo/token.txt. (2) Verify the NemoVideo service is legitimate and that the token's scope is limited (only video-generation, no broad account access). (3) Prefer setting a narrowly scoped API key in an environment variable rather than leaving credentials in a plaintext file; if you must store a file, ensure proper filesystem permissions. (4) Because this is instruction-only (no code for review), ask how the agent calls the external service and whether any studio or customer data is sent to third parties; request a privacy/security description. (5) If the developer cannot clarify the metadata vs SKILL.md inconsistency, treat the skill as untrusted until resolved.

Like a lobster shell, security has layers — review code before you run it.

latestvk977nr3g17cc1e1cfvbrxcnqy984e35b
171downloads
0stars
6versions
Updated 2w ago
v1.0.5
MIT-0

Yoga Studio Video

Capture the atmosphere that makes a student choose your studio and come back every week.

Use Cases

  1. Studio Introduction and Culture Video — Show the light, the space, the teaching style, and the class energy — the 90-second studio visit that converts search traffic into first-time students.
  2. Class Format and Style Showcase — Individual videos for vinyasa, yin, hot yoga, prenatal, restorative, and every style you offer — matched content that shows up when the right student is searching.
  3. Instructor Introduction Video — Put your teachers on camera to share their background, teaching philosophy, and what they believe yoga gives a student — the trust signal that turns curious into committed.
  4. Prenatal and Therapeutic Program Video — Speak directly to the student who needs reassurance that this program was designed for exactly where they are.
  5. Corporate Wellness Program Video — Communicate the business and human case for workplace yoga to the HR teams and managers who make the decision.

How to Use

Describe your studio — the styles you teach, the instructors who define your culture, the students you serve, and any signature programs or experiences. Yoga Studio Video creates content that communicates atmosphere, not just information.

Example prompt: "Create a studio introduction video for Sunrise Yoga, a vinyasa and yin studio in Austin. Small classes, heated room, two main instructors. Primary audience is working adults 28-45 who want a consistent practice without the gym energy. Highlight the morning light, the teacher attention ratio, and the community of regulars."

Setup

Store your NemoVideo token at ~/.config/nemovideo/token.txt or set the NEMO_TOKEN environment variable.

Comments

Loading comments...