Back to skill
Skillv1.0.0
ClawScan security
Text To Video Filmora · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 21, 2026, 2:01 PM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's requests and runtime instructions are broadly consistent with a text->video cloud-rendering integration, but there are a few minor metadata/instruction mismatches you should verify before installing.
- Guidance
- Before installing: verify you trust the domain (mega-api-prod.nemovideo.ai) and the skill author (source is unknown). Understand that any files you upload (text, DOCX, SRT, MP4) will be transmitted to that external service — do not upload sensitive material unless you accept that. Ask the publisher to clarify the frontmatter vs registry metadata mismatch (the SKILL.md lists ~/.config/nemovideo/ and install-path heuristics); confirm whether the skill will inspect those paths or other files. Prefer using an anonymous ephemeral token when possible and avoid putting long-lived, high-privilege credentials in NEMO_TOKEN unless you trust the service. If you proceed, monitor activity and be prepared to revoke the token and remove any local config the skill may create. If you need higher assurance, request the skill's source/homepage or ask for an author signature before installing.
Review Dimensions
- Purpose & Capability
- okThe skill claims to convert text to video and only requests a single service credential (NEMO_TOKEN) and uses documented API endpoints on mega-api-prod.nemovideo.ai — this matches the claimed purpose. Note: the skill's YAML frontmatter lists a config path (~/.config/nemovideo/) but the registry metadata earlier said no config paths; that's an inconsistency to clarify.
- Instruction Scope
- noteRuntime instructions direct the agent to: use NEMO_TOKEN (or obtain an anonymous token), create sessions, upload user files (multipart file uploads or URLs), stream SSEs, and poll renders. These actions are expected for a cloud video service. The instructions also tell the agent to derive an X-Skill-Platform header by inspecting install paths (e.g., ~/.clawhub/, ~/.cursor/skills/), which requires reading filesystem paths — not strictly necessary for core functionality and worth asking about. The skill does not instruct reading unrelated environment secrets.
- Install Mechanism
- okThis is instruction-only with no install spec and no code files — nothing is written to disk by an installer. That minimizes install-time risk.
- Credentials
- noteOnly one credential is declared (NEMO_TOKEN) which is proportional for a service API. The SKILL.md also references a config path in frontmatter (~/.config/nemovideo/), which could imply reading local config files; the registry metadata did not list that path. Confirm whether the skill will access that directory and why.
- Persistence & Privilege
- okalways:false (default) and no install-time persistence is requested. The agent is instructed to save session_id for the user's session (expected). Autonomous invocation is allowed by default — this is normal but increases blast radius if the skill were malicious (no other red flags here).