Back to skill
Skillv1.0.0
ClawScan security
Recording Editor Online · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousApr 25, 2026, 2:36 AM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's behavior largely matches a remote video-editing service (it needs a NEMO_TOKEN and calls nemovideo.ai), but there are metadata inconsistencies and some minor scope questions you should understand before installing.
- Guidance
- This skill appears to be a wrapper for a hosted video-editing service at mega-api-prod.nemovideo.ai and reasonably needs a service token (NEMO_TOKEN). Before installing: 1) Verify the publisher/source and privacy/storage policy for uploaded videos — you will be sending recording files to their servers. 2) Prefer using a short-lived or anonymous token (the skill supports obtaining an anonymous starter token) rather than a permanent secret. 3) Ask the publisher to clarify the metadata mismatch about ~/.config/nemovideo/ and whether the agent will read local config or install paths to set X-Skill-Platform. 4) If you handle sensitive recordings, don't upload them until you confirm where they are stored, retention policy, and who can access them. If any of these questions are unanswered or you can't trust the upstream service, treat this skill as potentially risky.
Review Dimensions
- Purpose & Capability
- noteName/description match the runtime instructions: the SKILL.md tells the agent to authenticate (NEMO_TOKEN or anonymous token) and call endpoints on mega-api-prod.nemovideo.ai to upload, edit, and render video. That credential and network access are proportional to a remote video-editing service. However, frontmatter metadata declares a config path (~/.config/nemovideo/) even though the registry summary listed no required config paths — this mismatch is unexplained and worth confirming with the publisher.
- Instruction Scope
- okAll runtime actions described are limited to the nemo backend: obtaining/using a token, creating sessions, uploading files, streaming SSE, polling state, and starting renders. The instructions do not ask the agent to read arbitrary system files or unrelated credentials. They do require detecting an install path to set X-Skill-Platform which may involve reading agent state/paths — confirm what 'auto-detect' access entails in your environment.
- Install Mechanism
- okThis is an instruction-only skill with no install spec or code files, so nothing is written to disk by the skill itself. That is the lowest-risk install model.
- Credentials
- concernThe single declared primaryEnv is NEMO_TOKEN, which is appropriate for a hosted editing service. But the frontmatter also lists configPaths (~/.config/nemovideo/) even though the registry stated none — it's unclear whether the agent will attempt to read that path. Confirm whether the skill will read any local config or other env vars, and avoid supplying long-lived/privileged tokens unless you trust the service.
- Persistence & Privilege
- okalways is false and the skill does not request system-wide changes or modifications to other skills. It can be invoked autonomously (the platform default), which is expected for skills that handle requests automatically.