Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Best Viral Title Generator
v1.0.0Get viral title suggestions ready to post, without touching a single slider. Upload your video content details (MP4, MOV, AVI, WebM, up to 500MB), say someth...
⭐ 0· 58·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description emphasize generating titles, but the SKILL.md focuses on a full cloud video render/edit pipeline (uploads, SSE, exports, credits, session state). Requesting a NEMO_TOKEN and detailed render endpoints is plausible for a video-processing service, but the scope (remote rendering, downloads, compositing) is much broader than a simple 'title generator' and may surprise users.
Instruction Scope
Instructions direct the agent to obtain or use a bearer token (NEMO_TOKEN), create sessions, upload user files (up to 500MB), open SSE streams, poll export jobs, and download rendered media from https://mega-api-prod.nemovideo.ai. These behaviors transmit user video content and session tokens to an external service — appropriate for a render tool, but not obviously necessary for mere title suggestion. The SKILL.md also tells the agent to 'save session_id' without specifying where or how, which could imply persistent state writes.
Install Mechanism
Instruction-only skill with no install spec and no code files. That minimizes disk-side attack surface (nothing is downloaded/installed by the skill itself).
Credentials
Only NEMO_TOKEN is declared as the required credential, which is proportionate to a remote rendering/video-processing service. However, frontmatter metadata includes a config path (~/.config/nemovideo/) that is inconsistent with the registry summary and suggests the skill may read/write local config; that should be clarified. The skill will also upload potentially large media files to an external endpoint — a privacy consideration.
Persistence & Privilege
always:false (normal). The SKILL.md instructs saving session_id and token handling (including creating an anonymous token) but does not specify storage location or lifetime. The frontmatter's configPaths implies possible local persistence; users should confirm whether session data or tokens are written to disk and where.
What to consider before installing
This skill will upload your video files and use a remote service (mega-api-prod.nemovideo.ai) and a bearer token (NEMO_TOKEN) to create sessions, run SSE, and render/download media — behavior more like a cloud video editor than a simple title-suggester. Before installing: (1) Verify you trust the nemovideo.ai domain and review its privacy/terms because your videos will be transmitted and processed remotely. (2) Prefer using an ephemeral/limited token or anonymous token flow rather than a long-lived account token. (3) Ask the developer where session_id and tokens are stored (frontmatter suggests ~/.config/nemovideo/). (4) Don’t upload sensitive content unless you understand retention and access controls. (5) If you only want title suggestions, consider a skill that does generation locally or that clearly documents that it will not upload your media.Like a lobster shell, security has layers — review code before you run it.
latestvk97dcayx6j33q842a4gccdtsms84qsd4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎯 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN