Back to skill
Skillv1.0.0
ClawScan security
Editor Maker Generator · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousApr 26, 2026, 12:30 AM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's behavior mostly matches a cloud video-editing integration, but there are metadata inconsistencies and ambiguous token persistence/metadata that you should understand before installing or uploading files.
- Guidance
- This skill appears to be a front-end for a cloud video-editing service and will upload any videos you send to https://mega-api-prod.nemovideo.ai. Before installing or using it: 1) Confirm you trust nemovideo.ai and are comfortable with them receiving your video/audio files (privacy/data retention). 2) Ask how the skill stores the anonymous NEMO_TOKEN (temporary in-memory vs saved to environment or ~/.config/nemovideo/). The SKILL.md and registry metadata disagree about config paths. 3) Do not provide other unrelated credentials; only NEMO_TOKEN is needed. 4) If you require audits/compliance, request the service’s privacy and retention policy and verify where uploads are stored and who can access them. If you’re unsure about token persistence or the platform-detection behavior (it may inspect install paths), treat the skill as untrusted until the publisher clarifies those points.
Review Dimensions
- Purpose & Capability
- noteThe name/description (cloud AI video editing) align with the runtime instructions (uploading video, creating sessions, exporting MP4). Required credential (NEMO_TOKEN) is expected. However, the SKILL.md frontmatter declares a config path (~/.config/nemovideo/) while the registry metadata lists no required config paths — this inconsistency is unexplained.
- Instruction Scope
- concernInstructions tell the agent to upload user video files and other data to https://mega-api-prod.nemovideo.ai and to generate or accept a NEMO_TOKEN. Uploading user content to a remote service is expected for an editing backend, but the SKILL.md is ambiguous about whether and where the obtained anonymous token is persisted (environment, config path, or only in-memory). The instructions also require sending custom headers derived from local install path detection (X-Skill-Platform), which implies the agent may inspect install paths. The skill does not instruct reading unrelated system files, but the platform-detection step could cause the agent to access a path.
- Install Mechanism
- okInstruction-only skill with no install steps and no code files — lowest install risk. No downloads or third-party packages are requested.
- Credentials
- noteOnly NEMO_TOKEN is declared as required, which is proportionate for a cloud editing service. The SKILL.md also describes obtaining an anonymous NEMO_TOKEN via an API call if none exists — normal, but the skill claims a config path in metadata (see above) without explaining whether tokens/config will be stored there.
- Persistence & Privilege
- okalways:false and no install-time persistence is declared. The skill does not request elevated or persistent platform privileges. The only autonomy-related concern is normal: the agent can call the service when invoked.