ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Free Ai Video Generator With No Restrictions

v1.0.1

Get 1080p MP4 files from your text prompts or clips using this free-ai-video-generator-with-no-restrictions tool. It runs AI video generation on cloud GPUs,...

⭐ 0· 33·0 current·0 all-time
by@vcarolxhberger
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
ℹ
Purpose & Capability
The skill claims to generate videos via NemoVideo and only requests a single NEMO_TOKEN credential, which is coherent. However the SKILL.md frontmatter references a config path (~/.config/nemovideo/) while the registry metadata lists no required config paths; the package has no homepage and an unknown owner — this mismatch and lack of provenance are unexplained.
ℹ
Instruction Scope
The SKILL.md instructs the agent to upload user-provided clips/text to https://mega-api-prod.nemovideo.ai, obtain or use an anonymous token, open sessions, stream SSE, poll state, and export rendered files — all expected for a remote video service. Two points to note: (1) it requires constructing and sending custom attribution headers (X-Skill-Source, X-Skill-Version, X-Skill-Platform) which may reveal local install-path-derived information; (2) it instructs saving session_id and not to print tokens, which is reasonable, but the instructions will cause user data (video/audio) to be sent off-host — so sensitive content will be transmitted to a third party.
✓
Install Mechanism
Instruction-only skill with no install spec and no code files — nothing is written to disk by the skill itself. This is lower install risk.
ℹ
Credentials
Only NEMO_TOKEN is required and is clearly the primary credential for the API, which is proportionate. Caveats: the SKILL.md frontmatter references a config path (~/.config/nemovideo/) not reflected in the registry metadata (inconsistency), and the required headers may leak local install-path identification. Do not reuse other sensitive credentials as NEMO_TOKEN.
✓
Persistence & Privilege
always is false and the skill does not request elevated or persistent platform privileges. It will run when invoked and can be auto-invoked by the agent (platform default).
What to consider before installing
This skill appears to do what it says (send prompts/clips to a remote NemoVideo API and return generated MP4s), but exercise caution: the package has no homepage or clear author, and the SKILL.md and registry metadata disagree about a config path. Installing will cause your files (and a bearer token) to be sent to mega-api-prod.nemovideo.ai. Before installing: 1) Verify the service/domain and its privacy/policy (who can access uploaded content). 2) Do not supply sensitive or proprietary footage. 3) Do not reuse other credentials as NEMO_TOKEN (use a token scoped for this service). 4) Ask the publisher to clarify the configPath discrepancy and what X-Skill-Platform header will contain (it can leak install-path info). If you cannot verify the service or author, avoid installing or run it in an isolated environment.

Like a lobster shell, security has layers — review code before you run it.

latestvk9719mz5eyktagx9565mzgk86584ep3x

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments