Back to skill
Skillv1.0.0
ClawScan security
Video Editing With Facebook · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousApr 11, 2026, 1:42 AM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill claims to produce Facebook-ready videos but routes all work through a third‑party 'nemovideo' backend, auto-creates/stores anonymous tokens, and contains small metadata/instruction mismatches — these inconsistencies warrant caution before installing.
- Guidance
- This skill hands all uploads and processing to a third‑party service (mega-api-prod.nemovideo.ai) and will automatically obtain and use an anonymous NEMO_TOKEN if one isn't provided. Before installing: (1) Confirm you are comfortable uploading videos (and any contained PII) to that external service. (2) Ask where the anonymous token and session IDs are stored (in-memory only vs written to ~/.config/nemovideo/). (3) Require explicit user consent before any automatic outbound upload/connect on first open. (4) Note the skill name mentions Facebook but it does not talk to Facebook APIs — if you expected direct Facebook publishing, this skill does not do that. If you need stronger assurance, request the skill author/source, an explicit privacy policy for nemovideo.ai, and clarification about local config writes; without that, treat the skill as untrusted for sensitive content.
Review Dimensions
- Purpose & Capability
- noteName and description emphasize 'Facebook' optimization, but the runtime instructions never call Facebook APIs or request Facebook credentials — instead they use a third‑party service (mega-api-prod.nemovideo.ai). This can be reasonable if the skill only formats videos for Facebook, but the naming could mislead users into thinking it integrates with Facebook directly.
- Instruction Scope
- concernThe SKILL.md instructs the agent to automatically connect to an external backend on first use, POST to endpoints to obtain an anonymous token and create sessions, upload user media files, and store session tokens. It also tells the agent to read the skill's own frontmatter and detect install paths to populate attribution headers. Automatic outbound network activity and file-system inspection (install path detection) on first open are notable privacy/behavioral concerns and should be made explicit to users.
- Install Mechanism
- okThis is an instruction-only skill with no install spec and no code files — nothing is written to disk by an installer, which lowers risk. There is no package download or external installer invocation in the manifest.
- Credentials
- noteThe only declared credential is NEMO_TOKEN, which aligns with using the nemovideo backend. However, the skill metadata in SKILL.md references a config path (~/.config/nemovideo/) while the registry metadata listed none — this mismatch is unexplained and suggests the skill may read/write a local config directory in practice.
- Persistence & Privilege
- noteThe skill does not request 'always: true' and appears not to modify other skills or global settings. Still, it instructs storing session IDs and potentially the anonymous token for up to 7 days; where/how those tokens are persisted (in-memory vs on-disk under ~/.config/nemovideo/) is not specified, which affects long-term privilege/persistence.