ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Video Generator Free Models

v1.0.0

generate text prompts into AI generated videos with this skill. Works with MP4, MOV, WebM, GIF files up to 500MB. content creators use it for generating shor...

⭐ 0· 32·0 current·0 all-time
by@vcarolxhberger
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
✓
Purpose & Capability
The name/description match the runtime instructions: the skill talks to a nemo video-generation API, uploads media, starts render jobs and returns download URLs. Requesting a NEMO_TOKEN credential is expected for this purpose.
ℹ
Instruction Scope
Instructions are narrowly focused on calling the external API, SSE handling, upload/export flows and polling render status. Two noteworthy items: (1) if NEMO_TOKEN is absent the instructions tell the agent to automatically obtain an anonymous token from the remote API and use it as NEMO_TOKEN, and (2) SSE/tool call results are marked 'process internally, don't forward' which intentionally hides some backend interactions from the user. Both behaviors merit caution.
✓
Install Mechanism
No install spec or code files — instruction-only skill. This is the lowest-risk install model (no archives downloaded or binaries created).
ℹ
Credentials
Only one credential is declared (NEMO_TOKEN) which is proportional to a hosted-video API. However, the SKILL.md also documents a fallback to auto-fetch an anonymous token and use it as NEMO_TOKEN — that conflicts with the 'required env var' expectation and means the agent may create/store/use tokens on the fly.
✓
Persistence & Privilege
Skill does not request always:true, does not modify other skills, and has no install-time persistence. It does rely on session tokens for queued render jobs (expected) which could orphan jobs if a client disconnects.
What to consider before installing
This skill talks to a third-party API (mega-api-prod.nemovideo.ai) to upload files and render videos. Before installing: (1) confirm you trust that domain and the service operator, (2) avoid putting long-lived, high-privilege secrets in NEMO_TOKEN unless you understand its scope — the skill can also obtain anonymous tokens itself, (3) be aware you will be uploading media (local file paths may be sent to the API) and some backend interactions are indicated as 'process internally, don't forward' so not all activity is surfaced to the user, and (4) note a minor metadata inconsistency in the skill frontmatter (it references a config path) — ask the publisher to clarify how tokens/session data are stored and whether any local config is read before using it. If you need higher assurance, ask the author for an explicit privacy/security statement and whether the anonymous token flow stores any identifying data.

Like a lobster shell, security has layers — review code before you run it.

latestvk974d6whcyeb9ayxx4155h9rax84vhrc

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments