Skillv1.0.0

ClawScan security

Xiaohongshu Video · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

BenignApr 18, 2026, 5:16 AM

Verdict: benign
Confidence: medium
Model: gpt-5-mini
Summary: The skill's requirements and runtime instructions are internally coherent for a cloud video-creation service, but it will upload your media and create/hold service tokens on your behalf — review the remote service and privacy implications before using.
Guidance: This skill sends your uploaded media and session tokens to mega-api-prod.nemovideo.ai and will create a short-lived anonymous token if you don't provide one. Before installing or using: 1) Confirm you trust the nemo/nemovideo service and its privacy policy; 2) Avoid uploading sensitive or private media (test with non-sensitive files first); 3) If concerned, supply your own NEMO_TOKEN so you control the credential lifecycle and revoke it when done; 4) Be aware the skill may write session state under ~/.config/nemovideo/ — delete that folder or revoke tokens when finished; 5) Monitor network activity and token values if you have security tooling. I rate the skill coherent for its purpose but the primary risk is data/credential sharing with an external service, not local code execution.

Review Dimensions

Purpose & Capability: okThe name/description (create Xiaohongshu vertical videos) match the actions described in SKILL.md: creating sessions, uploading media, running cloud renders and returning download URLs. Requesting a NEMO_TOKEN and referencing nemovideo.ai endpoints is proportionate to that purpose. The metadata's config path (~/.config/nemovideo/) and primaryEnv NEMO_TOKEN are consistent with storing session state/tokens.
Instruction Scope: noteAll runtime instructions stay within the stated purpose (create/edit/export videos): they create sessions, send SSE chat messages, upload media up to 500MB, poll export status, and return download URLs. Important behavioral notes: the skill will (a) auto-create an anonymous token if NEMO_TOKEN is missing, (b) instruct storing a session_id for subsequent requests, (c) require specific attribution headers on every request, and (d) may detect install/platform paths. These behaviors are expected for a cloud rendering workflow but do mean user data (media) and session tokens are sent to and persisted by a third-party service.
Install Mechanism: okInstruction-only skill with no install spec or code files — lowest local install risk. The security surface is entirely runtime network I/O to mega-api-prod.nemovideo.ai and local storage of session state, not package installs or extracted archives.
Credentials: noteOnly one environment variable (NEMO_TOKEN) is declared as required/primary, which is appropriate. The skill also creates an anonymous token via the API if the env var is absent — reasonable but means the skill will obtain and use credentials on the user's behalf. If you provide a NEMO_TOKEN it will be used and possibly persisted; if not, the skill will mint a short-lived token automatically.
Persistence & Privilege: noteThe skill is not 'always' enabled and does not request elevated platform privileges. It does instruct storing session_id and references a config path (~/.config/nemovideo/), so it will persist session state/tokens locally and on the backend. Backend jobs may be orphaned if the session is closed, and persisted tokens/sessions could remain until expired or revoked.