Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Nemo Video Quick
v1.0.0Skip the learning curve of professional editing software. Describe what you want — trim silences, add transitions, and export in under a minute — and get edi...
⭐ 0· 36·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description align with required credential NEMO_TOKEN and the documented endpoints; the skill is an interface to a cloud video-rendering backend, which reasonably needs an API token and upload capability. No unrelated services or binaries are requested.
Instruction Scope
Runtime instructions instruct the agent to (a) automatically obtain an anonymous token via a backend endpoint if NEMO_TOKEN is not set, (b) create and store a session_id, and (c) upload user video files to mega-api-prod.nemovideo.ai. The doc also instructs the agent to derive attribution headers from the agent's install path (which requires reading local paths). The token/session storage location and retention are unspecified. Uploading user videos to a third-party service and automatic token creation/storage are privacy-sensitive and should be explicit to the user.
Install Mechanism
Instruction-only skill with no install spec or bundled code — low install-attack surface. Nothing is downloaded or written by an installer according to the manifest.
Credentials
Only NEMO_TOKEN is declared as required, which is appropriate for a cloud video service. However, the SKILL.md frontmatter/metadata references a config path (~/.config/nemovideo/) and asks to detect install-path for attribution headers; the registry listing stated 'Required config paths: none'. This mismatch (metadata implying local config access) should be clarified. No other credentials are requested.
Persistence & Privilege
always:false (normal). The skill will autonomously connect to the backend on first use and may generate/store a short-lived anonymous token (7 days) and session_id; those actions broaden the skill's ability to transmit user data to the remote service. This is expected for a cloud-editing skill but increases privacy risk if not transparent.
What to consider before installing
This skill appears to be a straightforward cloud video-editing client, but review these points before installing:
- Privacy of uploads: The skill uploads your raw video files to mega-api-prod.nemovideo.ai for processing. Do not upload sensitive or confidential footage unless you trust the service and have reviewed its privacy policy and retention rules.
- Token handling: If you don't provide NEMO_TOKEN, the skill will automatically request an anonymous token from the backend and use/store it (100 free credits, 7 days). Ask how/where the agent stores that token and session_id, and whether it persists beyond the current session.
- Local path/config reads: The skill asks to derive attribution headers from the agent install path and the frontmatter references a local config directory (~/.config/nemovideo/). Confirm whether the skill will read local files or directories and what it will access; prefer a version that only reads what you explicitly permit.
- Domain and trust: The backend domain (mega-api-prod.nemovideo.ai) is not accompanied by a homepage/owner info in the registry metadata. If you rely on this skill, verify the service operator and their policies, or provide your own NEMO_TOKEN from a trusted account.
- Limit scope: If possible, use the skill first with non-sensitive test clips to confirm behavior. If you are uncomfortable with automatic token creation or unspecified storage, ask for a variant that requires you to paste an explicit token each session instead of auto-generating.
If you want, I can list exact questions to ask the skill author (where tokens are stored, which files/dirs are read, retention policy for uploaded media) or draft a safe usage checklist for trialing the skill.Like a lobster shell, security has layers — review code before you run it.
latestvk979k2qjj08syh9sg7swbwn0h184xb4k
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
⚡ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN