Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Ai Video Editor For Youtube
v1.0.0edit raw video footage into polished YouTube videos with this skill. Works with MP4, MOV, AVI, WebM files up to 500MB. YouTubers use it for editing and enhan...
⭐ 0· 49·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (cloud AI video editing) matches what the SKILL.md does: it uploads user video and calls a nemo video API to create edits and export MP4s. Requiring a NEMO_TOKEN is expected. Minor inconsistency: registry metadata listed no required config paths, but the skill's YAML frontmatter declares a configPaths entry (~/.config/nemovideo/) — this mismatch should be resolved.
Instruction Scope
The instructions explicitly direct the agent to POST files and commands to https://mega-api-prod.nemovideo.ai (session creation, upload, render), and to generate an anonymous token if NEMO_TOKEN isn't present. Sending user video to that external backend is necessary for the stated purpose, but it is a significant privacy action and should be clear to the user. The skill also asks the agent to read the skill's YAML frontmatter and detect install path for attribution headers (may require inspecting local install path). The instructions are otherwise scoped to editing tasks and do not request unrelated system credentials.
Install Mechanism
No install spec and no code files (instruction-only) — the lowest install risk. Nothing is downloaded or written by an installer step in the manifest.
Credentials
Only NEMO_TOKEN is declared as required which is proportional for a cloud API. However, the skill will generate and use an anonymous token by calling the provider's auth endpoint when a token is not present — this is acceptable but means credentials are created dynamically and used to upload user content. Also note the metadata's configPaths entry (~/ .config/nemovideo/) conflicts with the registry's 'none' and implies potential file access that was not declared elsewhere.
Persistence & Privilege
The skill is not always-enabled, does not request elevated privileges, and does not modify other skills or system-wide settings in the provided instructions. Autonomous invocation is allowed but it's the platform default.
What to consider before installing
This skill will upload whatever video files you send to a third‑party API (mega-api-prod.nemovideo.ai) for cloud GPU processing. That is coherent with its purpose but has privacy implications: do not upload sensitive or private footage unless you trust the service. Points to consider before installing or using it:
- Origin and trust: the skill has no listed homepage or source; verify the provider and its privacy/retention policy before sending real content.
- Token handling: the skill accepts NEMO_TOKEN if you provide one, or will request an anonymous token for you. Understand where tokens are stored and how long they are valid (anonymous tokens expire after 7 days per the instructions).
- Metadata mismatch: the skill frontmatter mentions a config path (~/.config/nemovideo/) even though the registry reported none — ask the maintainer to explain why the skill might read that path.
- Attribution headers: the skill tries to detect install path to set X-Skill-Platform, which may involve reading local paths — consider whether that leaks local environment details you don't want shared.
- Safety and costs: the API enforces credits and subscription rules (errors for no credits/blocked export). Confirm pricing/limits before relying on exports.
If you need higher assurance, request the skill's source or official vendor documentation, run tests with non-sensitive sample videos first, or prefer an editor that runs locally so your raw footage never leaves your machine.Like a lobster shell, security has layers — review code before you run it.
latestvk97cc066e10s4xnsevqvp4bcvn84qyvq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
