Back to skill
Skillv1.0.0
ClawScan security
Ai Video Editor Gopro · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 21, 2026, 6:20 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill’s declared purpose (cloud AI editing of GoPro footage) lines up with its runtime instructions and requested credential; nothing requested appears unrelated or disproportionate.
- Guidance
- This skill appears to do what it says: it uploads your video to a cloud backend for AI editing and requires a NEMO_TOKEN (it can also request an anonymous temporary token). Before installing, consider the privacy trade-offs of uploading raw footage to https://mega-api-prod.nemovideo.ai, confirm you trust that service, and avoid providing other unrelated credentials. Note the small metadata mismatch (a config path is mentioned in the skill frontmatter but not in the registry) — this is probably harmless but you can ask the skill author for clarification if you need assurance about where tokens/session data are stored.
Review Dimensions
- Purpose & Capability
- okName/description describe cloud video editing and the SKILL.md exclusively instructs API calls to a video-processing backend, upload/export flows, and session management. The single required credential (NEMO_TOKEN) is consistent with accessing that backend.
- Instruction Scope
- okInstructions focus on creating/using a session, uploading media, reading SSE for edits, polling for export status, and error handling. They do not instruct the agent to read unrelated system files, exfiltrate arbitrary secrets, or contact unknown endpoints outside the named backend (mega-api-prod.nemovideo.ai).
- Install Mechanism
- okThis is an instruction-only skill with no install spec and no code written to disk — lowest-risk installation model.
- Credentials
- noteOnly NEMO_TOKEN is required (declared as primary). SKILL.md also documents an anonymous-token exchange to obtain a temporary token if none is present, which is plausible for guest usage. The SKILL.md frontmatter mentions a config path (~/.config/nemovideo/) while the registry metadata earlier said no required config paths — this mismatch is minor but worth noting.
- Persistence & Privilege
- okalways is false, no persistent install or system-wide config modifications are requested. The skill keeps session IDs/tokens for its own operations but does not request elevated privileges or permanent presence.