Back to skill
Skillv1.0.0
ClawScan security
Ai Image To Video Clip · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousApr 24, 2026, 10:26 PM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill generally matches its stated purpose (upload images to a cloud renderer) but contains small inconsistencies around credentials and config access and will send user files to an external API — review before installing.
- Guidance
- This skill will upload your images and interact with https://mega-api-prod.nemovideo.ai to create video clips. Before installing: (1) Confirm you trust that external service and are comfortable uploading the types of images you plan to use (do not upload sensitive/private images unless you accept third-party processing). (2) Prefer supplying your own NEMO_TOKEN from a trusted account rather than relying on the skill's anonymous-token flow. (3) Note the metadata lists a local config path but the instructions don't use it — ask the author to clarify. (4) Review the service's privacy/retention policy and confirm the download URLs are time-limited. If you need higher assurance, request the skill source or implementation code so you can inspect exactly how files and tokens are handled.
Review Dimensions
- Purpose & Capability
- noteThe name and description map to cloud video-rendering actions and the SKILL.md details network calls to a nemo video backend, so required network access and a NEMO_TOKEN are expected. Minor inconsistency: the metadata declares a config path (~/.config/nemovideo/) that the instructions do not actually read or justify.
- Instruction Scope
- noteInstructions are explicit about creating sessions, uploading files (multipart or by URL), streaming SSE, and polling render status — all consistent with a cloud render skill. Two points to note: (1) if NEMO_TOKEN is missing the skill instructs the agent to obtain an anonymous token via POST, which means it will autonomously contact the external API to mint credentials; (2) the agent is asked to infer an X-Skill-Platform value from install path, which implies reading runtime/installation metadata.
- Install Mechanism
- okInstruction-only skill with no install spec or code files, so nothing is written to disk by an installer. Low install risk.
- Credentials
- noteOnly one credential (NEMO_TOKEN) is requested, which is proportional to a cloud rendering service. However, the SKILL.md provides a fallback flow to request an anonymous token if NEMO_TOKEN is absent — this contradicts the 'required env var' listing and means the skill can operate without a pre-provided secret. The declared configPath is not used in the runtime instructions.
- Persistence & Privilege
- okalways:false and no installation hooks; the skill does not request permanent system presence. The skill may be invoked autonomously by the agent (platform default), but that is normal and not in itself concerning.