Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Subtitle Generator Hinglish
v1.0.0generate video files into Hinglish captioned videos with this skill. Works with MP4, MOV, AVI, WebM files up to 500MB. Indian content creators use it for add...
⭐ 0· 32·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the runtime instructions: the skill uploads videos to a nemo video backend and returns captioned MP4s. Requesting a NEMO_TOKEN is appropriate for that purpose. However, the frontmatter metadata includes a configPaths entry (~/.config/nemovideo/) that the registry summary did not list — this mismatch is unexplained and could indicate stale metadata or an instruction to access a local config directory that the registry didn't surface.
Instruction Scope
SKILL.md instructs the agent to look for NEMO_TOKEN, and if missing to automatically POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token to obtain one, then create sessions, upload files, read SSE streams, and poll render endpoints. Those actions align with the described feature set (upload, render, download), but the auto-token acquisition and session management mean the agent will contact an external service and upload user video content. The instructions do not reference reading unrelated local files or creds, but they do require constructing attribution headers (X-Skill-Platform auto-detection via install path), which could cause the agent to examine its environment/install path.
Install Mechanism
Instruction-only skill with no install steps or code files; nothing is downloaded or written to disk by an installer. This is the lowest-risk install mechanism.
Credentials
Only a single credential (NEMO_TOKEN) is declared and used, which is proportionate to a cloud API. However, the skill's ability to obtain an anonymous NEMO_TOKEN on behalf of the user (without a prior explicit credential) means the agent will call an external auth endpoint and receive a token that grants 100 free credits — the user should be aware this creates short-lived credentials and external backend access. The metadata/configPaths mismatch (frontmatter lists ~/.config/nemovideo/) is unexplained and suggests the skill may expect a local config file in some deployments.
Persistence & Privilege
always is false and the skill does not request permanent platform-wide presence. It instructs the agent to keep session_id for the session lifecycle (normal). Autonomous invocation is allowed (platform default) but not an extra privilege here.
What to consider before installing
This skill appears to be a thin wrapper around a nemo-video cloud API and will upload user videos to https://mega-api-prod.nemovideo.ai and require/use a NEMO_TOKEN. Before installing, consider: 1) provenance — the skill has no homepage or known source; verify the provider and read its privacy/data-retention policy; 2) sensitive content — uploaded videos will be sent to an external service, so avoid private/secret material unless you trust the operator; 3) token behavior — the skill will auto-request an anonymous token if you don't provide one (100 free credits, short expiry) which means it will make outbound network calls immediately; 4) metadata mismatch — the frontmatter references a local config path (~/.config/nemovideo/) even though the registry didn't list it — ask the author why and whether local config files will be read; 5) headers/platform detection — the agent may inspect its install path to set X-Skill-Platform. If you proceed, prefer supplying your own NEMO_TOKEN from a trusted account (so you control the credentials) and monitor outgoing requests during first use. If you need higher assurance, ask the publisher for a homepage, privacy policy, and source code before using with sensitive content.Like a lobster shell, security has layers — review code before you run it.
latestvk97d2swnzm94y1qymw4z6yn2yh84tstx
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN