Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Best Wechat Video
v1.0.0Skip the learning curve of professional editing software. Describe what you want — trim the clip, add subtitles in Chinese and English, and export for WeChat...
⭐ 0· 28·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's need for an API token (NEMO_TOKEN) and network access to a remote video-processing backend fits its claimed purpose. However, the SKILL.md metadata includes a config path (~/.config/nemovideo/) and runtime steps that try to detect the agent install path (~/.clawhub/, ~/.cursor/skills/), while the registry metadata provided earlier listed no required config paths. This mismatch is unexplained and suggests extra filesystem access beyond simple upload/use.
Instruction Scope
Instructions tell the agent to automatically connect to an external API, obtain an anonymous token if none is present, store a session_id for subsequent requests, and detect install paths and skill frontmatter at runtime. Reading install paths and config directories (to set X-Skill-Platform) and storing session tokens are not necessary for basic upload/edit/export functionality and expand the skill's scope into local filesystem access and persistent state without specifying where/how data is stored.
Install Mechanism
There is no install spec and no code files — this is instruction-only. That minimizes installation risk (nothing is downloaded or written by an installer). The primary runtime risk comes from the network calls and filesystem access described in SKILL.md, not from an installer.
Credentials
The skill only declares one required environment variable (NEMO_TOKEN), which is reasonable for an API-backed service. But the SKILL.md also references a config directory (~/.config/nemovideo/) and implies storing session state there; those filesystem access requirements were not reflected in the registry metadata and are not justified in the description. That asymmetry increases privacy risk.
Persistence & Privilege
The skill is not force-enabled (always:false) and can be invoked by the user. It does instruct the agent to generate and persist a short-lived anonymous token and to store session_id for ongoing jobs. Persisting credentials/session state is common for remote services, but the instructions do not specify storage location or retention policy, which is an information governance concern rather than an immediate technical exploit.
What to consider before installing
Before installing or using this skill, consider the following:
- Network & privacy: The skill uploads your raw video to a third-party service (mega-api-prod.nemovideo.ai). Don't send sensitive footage you wouldn't want uploaded to an external GPU backend.
- Token & storage: The skill will look for NEMO_TOKEN and — if absent — request an anonymous token from the backend and store session IDs. Ask the maintainer where tokens/session state are stored (local file path, encryption, retention) and whether you can opt out of persistent storage.
- Filesystem access: SKILL.md instructs the agent to detect install paths and a config directory. If you prefer minimal local probing, do not grant the skill access to your home config directories or ask for a version that omits those checks.
- Metadata mismatch: Registry metadata did not list config paths but SKILL.md did. Treat this as a caution: verify the final manifest (as delivered by the registry) matches what's in SKILL.md.
- Domain verification: If you plan to use it, verify the backend domain and service (nemovideo) and confirm their privacy/terms. Consider getting an account-based API key rather than relying on anonymous tokens if you need auditability.
If you need strong guarantees (no uploads, no persistent tokens, no filesystem probing), do not install this skill until the author clarifies storage behavior and removes unnecessary filesystem checks.Like a lobster shell, security has layers — review code before you run it.
latestvk972t3mx9qcxnea09ka1f7zgvh84qxhq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
💬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
