Skillv1.0.0

ClawScan security

Recap Video · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

SuspiciousApr 26, 2026, 7:11 PM

Verdict: suspicious
Confidence: medium
Model: gpt-5-mini
Summary: The skill's behavior mostly matches a cloud-based video-compile tool, but there are inconsistencies in its metadata and it will automatically obtain/issue tokens and upload user video to a third-party service — you should be careful before installing or uploading sensitive files.
Guidance: This skill uploads user video to a third-party domain (nemovideo.ai) and will use either a NEMO_TOKEN from the environment or obtain an anonymous token automatically. Before installing or using it: (1) confirm you trust the nemovideo.ai service and its privacy/data retention policy; do not upload sensitive or private video unless you are comfortable with remote processing; (2) ask the publisher to explain the metadata mismatch about ~/.config/nemovideo/ (is the skill going to read that directory?); (3) if you prefer control, provide your own NEMO_TOKEN from an account you manage rather than relying on anonymous tokens; and (4) verify the homepage, ownership, or documentation for the service — the skill's registry entry lists no homepage and an unknown source, which reduces transparency. If you need higher assurance, request the skill author supply a privacy/security statement or a verified service homepage before use.
Findings: [no_regex_findings] expected: The static scanner found nothing to analyze because this is an instruction-only skill with no code files. That is expected but not an assurance of safety — the runtime instructions themselves are the primary surface to review.

Review Dimensions

Purpose & Capability: noteThe skill's name/description (cloud recap video compiler) align with the runtime instructions (upload clips, create session, render on nemovideo.ai). However the SKILL.md frontmatter declares a config path (~/.config/nemovideo/) while the registry metadata stated no required config paths — this mismatch is unexplained and worth confirming with the publisher.
Instruction Scope: noteInstructions are narrowly scoped to creating sessions, uploading files, reading SSE streams, and starting renders against https://mega-api-prod.nemovideo.ai. That matches the described purpose. Important privacy-impacting behavior: the skill will upload user-provided videos to a third-party cloud service and will automatically obtain an anonymous token if no NEMO_TOKEN is supplied. The SKILL.md does not instruct reading unrelated system files beyond the (discrepant) config path.
Install Mechanism: okNo install spec and no code files — instruction-only. This minimizes on-disk execution risk because nothing in the skill will be written to disk by an installer.
Credentials: concernOnly one env var (NEMO_TOKEN) is declared, which is proportionate to an API-backed service. However SKILL.md frontmatter includes a configPaths entry (~/.config/nemovideo/) that suggests possible access to local config; the registry listing omitted this. Also the skill will create an anonymous token via an API call if no NEMO_TOKEN is present, meaning it can operate without explicit user-provided credentials — reasonable for a free tier but worth noting that your uploads will still go to the remote service.
Persistence & Privilege: okThe skill does not request always:true, does not install anything, and does not ask to modify other skills or system-wide settings. It operates as a normal, non-persistent instruction-only skill.