Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Video Generation Ai Tools
v1.0.0Cloud-based video-generation-ai-tools tool that handles generating ready-to-share videos from text prompts or images. Upload MP4, MOV, PNG, JPG files (up to...
⭐ 0· 63·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (cloud video generation) match the single required credential (NEMO_TOKEN) and the described API endpoints. Declaring ~/.config/nemovideo/ for session storage is plausible. However, the skill also instructs detecting agent install paths (~/.clawhub/, ~/.cursor/skills/) to set X-Skill-Platform — this filesystem probing is not required for basic video generation and stands out as unnecessary.
Instruction Scope
Instructions direct the agent to automatically obtain an anonymous token (network call) and to store session_id for later requests; automatic network auth on first use is a privacy concern if done without explicit user consent. The runtime also instructs reading install paths to determine X-Skill-Platform and to include attribution headers — probing arbitrary home directories is scope creep. The upload workflow expects local file paths (reasonable for user-provided files), but the skill's instruction to 'don't display raw API responses or token values' indicates it will handle secrets silently, which reduces transparency.
Install Mechanism
Instruction-only skill with no install spec or bundled code, so nothing is written to disk by an installer. This is lower risk from install mechanism perspective.
Credentials
Only one required env var (NEMO_TOKEN) is declared which is proportional for a cloud API. The metadata also lists a config path (~/.config/nemovideo/) which may be used to persist session state — reasonable but worth confirming where sensitive tokens/session IDs are stored and with what permissions.
Persistence & Privilege
Skill is not always-on and uses default autonomous invocation. It requests no platform-wide config changes and does not declare writes to other skills' configurations. The main persistence behavior is storing a session_id and possibly config files under its own config path.
What to consider before installing
This skill largely does what it claims — it talks to a NemoVideo API and needs a NEMO_TOKEN. Before installing, consider: (1) The skill will, by default, auto-create an anonymous token and call the backend without an explicit opt-in — if you prefer control, set NEMO_TOKEN yourself. (2) It asks the agent to detect install paths (e.g., ~/.clawhub/, ~/.cursor/skills/) and may read your home directory to populate an X-Skill-Platform header — confirm you are OK with that filesystem access. (3) Ask where session tokens and returned session_id are stored and whether they are encrypted (metadata suggests ~/.config/nemovideo/). (4) Verify the backend domain (mega-api-prod.nemovideo.ai) and its privacy/policy before sending sensitive files. If you are uncomfortable with automatic network auth or probing of home directories, do not enable the skill or set NEMO_TOKEN manually and review where session state will be written.Like a lobster shell, security has layers — review code before you run it.
latestvk9741jgrz60hsgrefy595r72s984jcc2
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN