Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Daycare Marketing Video
v1.0.0Daycare centers with video on their Google Business Profile receive 42% more profile views and 3.1x more direction requests than centers with photos only. Da...
⭐ 0· 26·0 current·0 all-time
by@udnerc
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name and description describe a daycare video-marketing service (reasonable). The registry metadata declares a primary credential named NEMO_TOKEN and a config path (~/.config/nemovideo/), which plausibly match a third‑party video service. However, the SKILL.md itself never documents how or when that token/config will be used, so the declared credential is not clearly justified by the provided runtime instructions.
Instruction Scope
SKILL.md is primarily marketing/copy and high-level usage guidance: it asks the user to provide descriptions, photos, and reviews and promises to 'build' videos and a content calendar. It does not give explicit runtime steps, does not show calls to external APIs, and does not specify what data will be uploaded, where or how. This vagueness gives the agent broad discretion to collect and transmit user-supplied photos, reviews, and other PII; those data handling behaviors are not spelled out and should be clarified.
Install Mechanism
No install spec and no code files are included; this is instruction-only, so nothing will be written to disk by an installer. This is the lowest-risk install profile.
Credentials
The skill declares a primaryEnv (NEMO_TOKEN) and a config path (~/.config/nemovideo/) but SKILL.md does not explain why that credential/config is needed or what permissions it requires. Requesting a token that could allow upload/storage of user photos/videos is proportionate to a video service, but because usage and scope (upload, storage, sharing, retention) are unspecified, this presents a privacy/credential risk until clarified.
Persistence & Privilege
The skill is not always-enabled and has no special persistence flags. There is no indication it would modify other skills or system-wide settings. Autonomous invocation is allowed (platform default) but not, on its own, a new concern here.
What to consider before installing
Before installing, ask the publisher to clarify: (1) exactly how NEMO_TOKEN is used (what API/service; what permissions the token needs), (2) whether the skill will read the listed config path or any local files automatically, (3) what user data (photos, parent reviews, child images) will be uploaded, where it will be stored, and for how long, and (4) how parental consent and privacy for children in videos is handled. If you plan to provide photos or parent testimonials, avoid supplying sensitive/identifying child data until you have answers and a written data-retention/privacy policy. If the token would grant broad account access, consider creating a scoped token or a throwaway/test account instead of using a primary production credential.Like a lobster shell, security has layers — review code before you run it.
latestvk975zngfwbghhb73ndqz16wbbs841d1x
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🧸 Clawdis
Primary envNEMO_TOKEN