Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Video Editing With Instagram
v1.0.0Instagram creators edit video clips into Instagram-ready clips using this skill. Accepts MP4, MOV, AVI, WebM up to 500MB, renders on cloud GPUs at 1080p, and...
⭐ 0· 58·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description claim 'Instagram' formatted video editing and the runtime instructions consistently call a third-party rendering API (mega-api-prod.nemovideo.ai) to upload and process videos — that is coherent. However the skill name could be misleading: it does not integrate with Instagram's APIs (it only formats for Instagram), and the SKILL.md frontmatter references a config path (~/.config/nemovideo/) not declared in the registry requirements (registry shows no config paths). That metadata inconsistency is unexplained.
Instruction Scope
SKILL.md directs the agent to obtain (or use) a NEMO_TOKEN, create a session, upload user-supplied files, stream SSE edits, and poll render status. All actions are consistent with a cloud video-editing service. Important privacy-relevant behavior: user media and possibly metadata are uploaded to a third-party domain (mega-api-prod.nemovideo.ai). The instructions do not ask for unrelated environment variables or filesystem reads beyond the ambiguous install-path detection and the mentioned config path.
Install Mechanism
There is no install spec and no code files (instruction-only). That is lower risk because nothing is downloaded or written by an installer, but runtime will make network calls to the external API.
Credentials
The registry requires a single credential (NEMO_TOKEN) which matches the SKILL.md usage as the bearer token. However SKILL.md frontmatter mentions a config directory (~/.config/nemovideo/) and detection of install paths (to set X-Skill-Platform) which the registry earlier did not list — this mismatch should be clarified. Requesting only one token is proportionate, but the implied ability to read a config path (if implemented) would expand access and should be explained.
Persistence & Privilege
The skill does not request always: true and is user-invocable only. It does allow normal autonomous invocation (platform default). Nothing in the skill attempts to modify other skills or system-wide agent settings.
What to consider before installing
This skill uploads your videos to mega-api-prod.nemovideo.ai and requires a NEMO_TOKEN (it can generate a short-lived anonymous token). Before installing: 1) Confirm you trust the nemovideo.ai domain and review its privacy/terms because your media will be uploaded; 2) Verify the mismatch between registry metadata (no config paths) and SKILL.md (mentions ~/.config/nemovideo/) — ask the publisher whether the skill will read that folder; 3) Be aware the name references Instagram but it does not interact with Instagram APIs (it only formats for Instagram); 4) Test with non-sensitive sample clips first and avoid supplying videos containing private data; 5) If you need stronger assurance, ask the publisher for source/homepage and a clear privacy policy. If you want, I can draft questions to ask the publisher or check the nemovideo.ai domain for public documentation.Like a lobster shell, security has layers — review code before you run it.
latestvk972sbvdkb8y9g6f7efp7ts45s84m8j8
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📱 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN