Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Video Editor Jobs
v1.0.0Turn your editing skills into a steady stream of job opportunities with this dedicated assistant for video-editor-jobs. Whether you're hunting for freelance...
⭐ 0· 28·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to be a job-search/career assistant but its runtime instructions target a media-processing backend (mega-api-prod.nemovideo.ai) with endpoints for rendering, uploading video files, and session-based SSE. While accepting a portfolio upload can be justified for a video-editor assistant, endpoints like render/proxy/lambda and continuous SSE are heavier than strictly needed for job search and suggest the skill both processes media and indexes jobs. This broad capability is not clearly explained by the description and may be disproportionate.
Instruction Scope
SKILL.md instructs the agent to always establish a session with an external API and to upload user-provided files (resume, reels) to that service; it also instructs generation of an anonymous token if no NEMO_TOKEN is present. It tells the agent to 'keep the technical details out of the chat', which implies network/auth actions will happen without exposing them to the user. The instructions also require detecting an install path to set an attribution header. These behaviors involve reading/using local context and transmitting user data externally and are broader than a purely advisory job-search assistant.
Install Mechanism
No install spec and no code files — instruction-only. That reduces disk-write risk since nothing will be installed by the skill bundle itself.
Credentials
The skill declares one primary credential (NEMO_TOKEN), which matches the API usage in SKILL.md. However, the SKILL.md frontmatter also references a local config path (~/.config/nemovideo/) not listed in the registry metadata — a metadata mismatch. The requirement to generate or use tokens and to upload files to an external API is significant and should be justified explicitly by the author; otherwise it can result in unintentional disclosure of resumes, reels, or other PII to the service.
Persistence & Privilege
The skill is not always:true and does not request system-level persistence or modifications to other skills. It uses standard agent invocation and does not request elevated platform privileges.
What to consider before installing
Before installing, consider that this skill will: (1) connect to an external domain (mega-api-prod.nemovideo.ai) for every user request, (2) use either your provided NEMO_TOKEN or obtain an anonymous token itself, and (3) may upload resumes, reels, or other files to that service (and even invoke rendering endpoints). There is also a mismatch between the registry metadata and the SKILL.md about a local config path (~/.config/nemovideo/). Ask the author for clarifications: what data is sent to the backend, why rendering/upload endpoints are needed for job search, whether the service has a privacy policy, and whether you can opt out of uploads. If you have sensitive material you do not want transmitted, do not install or do not provide files; use a throwaway/limited token if you want to test. Because the homepage/source are missing and metadata is inconsistent, proceed cautiously or ask for a verified source before use.Like a lobster shell, security has layers — review code before you run it.
latestvk97fzmrqw3fkymm8m8r7sn7zc9843fc5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN