Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Free Text To Video Llm
v1.0.0Skip the learning curve of professional editing software. Describe what you want — generate a 30-second video of a futuristic city at dusk with cinematic lig...
⭐ 0· 19·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The declared purpose (generate videos from text) matches the runtime instructions: session creation, SSE chat, uploads, and export endpoints for a remote rendering service. However the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) while the registry metadata reported no required config paths — a minor inconsistency in declared requirements.
Instruction Scope
Instructions explicitly require checking for NEMO_TOKEN and, if absent, POSTing to https://mega-api-prod.nemovideo.ai to obtain an anonymous token, then uploading user text/files (up to 500MB) and job data to that service. This is consistent with the feature but means user content and metadata will be transmitted to a third party. The skill also instructs detecting install path to set an attribution header (reads agent install path), which requires environment inspection beyond just the NEMO_TOKEN.
Install Mechanism
No install spec and no code files (instruction-only). That minimizes local disk/write risk; all execution is network calls described in SKILL.md.
Credentials
Only a single credential (NEMO_TOKEN) is required, which matches the cloud API integration. The skill will create an anonymous token automatically if none is present (network call). The earlier-mentioned config path in SKILL.md frontmatter is not otherwise referenced in instructions — this mismatch should be clarified.
Persistence & Privilege
always is false and the skill does not request permanent platform-wide privileges. It creates remote sessions on the third-party backend (normal for this service) but does not request to modify other skills or system-wide settings.
What to consider before installing
This skill sends your prompts and any uploaded files to a third‑party rendering service (mega-api-prod.nemovideo.ai). It will also mint an anonymous token automatically if you don't provide NEMO_TOKEN, which means the skill can make outbound network requests without you first supplying credentials. Before installing: 1) Confirm you trust the nemovideo domain and review its privacy/retention policy (your text/files and any metadata will be transmitted and processed remotely). 2) If you prefer control, provide your own NEMO_TOKEN rather than relying on anonymous token creation. 3) Ask the publisher to clarify the conflicting config-path metadata (~/.config/nemovideo/) and any local file reads. 4) Avoid uploading sensitive or proprietary content unless you are comfortable with third‑party processing.Like a lobster shell, security has layers — review code before you run it.
latestvk9744trqs2fx4dw27hdm2161w984secg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN