Back to skill
Skillv1.0.0
ClawScan security
Ai Video Editor Gpt · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousApr 21, 2026, 3:00 PM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's declared purpose (cloud AI video editing) matches most of its instructions, but there are inconsistencies and privacy/persistence concerns — notably automatic anonymous token acquisition/storage, a metadata vs. registry mismatch about config paths, and filesystem fingerprinting — you should verify where tokens and uploads go before installing.
- Guidance
- Before installing, confirm these points: (1) The skill uploads your raw videos to https://mega-api-prod.nemovideo.ai — do not use it for sensitive footage unless you trust that domain and its privacy policy. (2) If you don't supply NEMO_TOKEN, the skill will auto-create an anonymous token and use it; ask where tokens and session IDs are stored (the frontmatter suggests ~/.config/nemovideo/). (3) Ask the publisher for a privacy/terms link and for clarification about the config path/metadata mismatch. (4) If you prefer control, supply your own NEMO_TOKEN rather than letting the skill generate one, and avoid installing if you cannot verify the backend/service operator.
Review Dimensions
- Purpose & Capability
- noteThe name/description (AI video editing) aligns with requiring a service token (NEMO_TOKEN) and uploading footage to a remote API. However, the SKILL.md frontmatter declares a config path (~/.config/nemovideo/) while the registry metadata lists no required config paths, which is an internal inconsistency. The skill also derives X-Skill-Platform by inspecting install paths, which requires reading filesystem locations that are not strictly necessary for core editing functionality.
- Instruction Scope
- concernRuntime instructions tell the agent to auto-request an anonymous token (POST to https://mega-api-prod.nemovideo.ai), create and store sessions, and upload user video files (multipart @/path or URL). That means user video content and session tokens will be sent to a third-party API. The SKILL.md also instructs the agent not to display raw API responses or token values and to persist session_id (storage location not specified). These behaviors are within the claimed purpose but broaden the skill's access surface (automatic credential issuance, persistent tokens, filesystem reads for platform detection) and raise privacy/persistence questions.
- Install Mechanism
- okThere is no install spec (instruction-only skill), so nothing is written to disk by an installer. This lowers supply-chain risk. Any persistence or file writes would come from runtime behavior described in SKILL.md rather than an installer.
- Credentials
- noteOnly one environment credential is declared (NEMO_TOKEN), which is appropriate for a cloud-rendering service. The skill also auto-generates an anonymous token if NEMO_TOKEN is absent — reasonable but notable because the token will be created and used without explicit user-provided credentials. The SKILL.md references config paths and install-path detection not declared in the registry, which should be clarified.
- Persistence & Privilege
- notealways:false and normal autonomous invocation are used (no elevated platform privilege). However, the skill expects to persist session_id and likely token information for subsequent API calls (frontmatter mentions a config path). Persisting tokens/sessions on disk increases risk if you don't know where/how they're stored or protected.