Back to skill
Skillv1.0.0
ClawScan security
Image To Video Generator Unrestricted · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 23, 2026, 4:40 AM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's requested access and runtime instructions are largely consistent with an image→video cloud service (it needs a NEMO_TOKEN or will obtain an anonymous token and then call nemovideo.ai APIs); nothing in the instructions suggests it will do unrelated or hidden actions, but there are small metadata inconsistencies and no public source/homepage to verify the backend.
- Guidance
- This skill appears to do what it says: it will call a nemovideo.ai backend to convert uploaded images into short videos and either use a provided NEMO_TOKEN or obtain a short-lived anonymous token for you. Before installing, consider: (1) Privacy — images are uploaded to a third-party cloud (verify you’re comfortable uploading any proprietary images). (2) Trust and verification — the skill has no public homepage/source; confirm you trust the backend domain (mega-api-prod.nemovideo.ai) and the skill owner. (3) Config-path ambiguity — the skill's frontmatter references ~/.config/nemovideo/ (potentially reading local config) although the registry listed no required config paths; ask the author to clarify why that path is needed. If you need higher assurance, request the skill's source code or a privacy/terms link and verify the backend operator and token handling policy.
Review Dimensions
- Purpose & Capability
- noteThe skill claims to convert images to short videos and all declared requirements (NEMO_TOKEN) and API calls in SKILL.md align with that purpose. Minor inconsistency: registry metadata listed 'Required config paths: none' while the skill frontmatter declares a configPath (~/.config/nemovideo/). This is likely benign but should be clarified.
- Instruction Scope
- noteRuntime instructions stay within the image→video domain: session creation, SSE for edits, uploads, render polling and exports. The skill also instructs reading its own YAML frontmatter and detecting install paths (~/.clawhub/, ~/.cursor/skills/) to set X-Skill-Platform — reading the install path is extraneous to core functionality but not clearly dangerous. Instructions explicitly prohibit exposing tokens or raw API output.
- Install Mechanism
- okNo install spec and no code files (instruction-only). That minimizes on-disk writes and arbitrary code installs — lowest-risk install mechanism.
- Credentials
- noteOnly NEMO_TOKEN is declared as required (primaryEnv). The skill will acquire an anonymous token itself if NEMO_TOKEN is absent, which is coherent for a service offering anonymous trials. The frontmatter's mention of a config path (~/.config/nemovideo/) conflicts with registry 'none' entry — reading that path could expose local config if present; this should be justified or removed.
- Persistence & Privilege
- okSkill is not always-enabled and uses normal model invocation. It stores session tokens/ids for the session lifecycle (expected). It does not request system-wide or cross-skill configuration changes.