ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Best Ai Video Editor

v1.0.0

Turn raw footage into polished, professional-quality videos without spending hours in complex software. This skill helps you find and use the best-ai-video-e...

⭐ 0· 31·0 current·0 all-time
by@whitejohnk-26
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
ℹ
Purpose & Capability
The skill's stated purpose is to recommend and guide use of the "best AI video editors," but the runtime instructions are tightly integrated with a single backend (mega-api-prod.nemovideo.ai). Recommending multiple third‑party tools is promised in the description, yet all actions route to NemoVideo; this is a scope mismatch (description vs actual integration). Requiring NEMO_TOKEN and a Nemo config path is otherwise consistent with a NemoVideo integration.
ℹ
Instruction Scope
SKILL.md instructs the agent to obtain/use a NEMO_TOKEN, create sessions, POST messages, upload video files (multipart or by URL), poll jobs, and handle SSE. Those actions are coherent for a cloud video processing skill. Important: the instructions explicitly upload user video data to an external service and will send Authorization headers (Bearer <NEMO_TOKEN>) and skill attribution headers with requests — users' media and metadata will leave the machine.
✓
Install Mechanism
This is an instruction-only skill with no install spec or downloaded code, so nothing is written to disk by an installer. That reduces risk from arbitrary installs.
ℹ
Credentials
Metadata declares a single required env var (NEMO_TOKEN) and a config path (~/.config/nemovideo/), which is proportionate for a cloud API client. However, SKILL.md contains logic to POST to an anonymous-token endpoint and extract a token if NEMO_TOKEN is absent — so the skill will obtain short‑lived credentials itself. This makes the metadata’s phrasing of NEMO_TOKEN as strictly required somewhat inconsistent. The skill does not request unrelated secrets, but any NEMO_TOKEN (anonymous or user-provided) grants access to the remote service and possibly to billing/credits.
✓
Persistence & Privilege
always is false and there is no install-time persistent agent modification described. The skill stores session_id for the session lifecycle only. There is no request for permanent platform-level privilege in the manifest.
What to consider before installing
What to consider before installing: - The skill will upload your video files and related metadata to mega-api-prod.nemovideo.ai and will include an Authorization: Bearer <NEMO_TOKEN> header. Don’t send sensitive or private footage unless you trust that service and its privacy policy. - Metadata lists NEMO_TOKEN as required, but the instructions will automatically request an anonymous token from the API if none is present (100 free credits, 7‑day expiry). Decide whether you want to provide your own token or allow the skill to create one. - The description suggests comparing many AI editors, but the runtime actually uses Nemovideo’s backend — expect the skill to be a client for that single provider rather than an impartial survey of tools. - Confirm ownership and reputation of nemovideo.ai, read their terms/limits and any billing implications before sending large jobs (credits, usage caps, or costs may apply). - The skill declares a config path (~/.config/nemovideo/) in metadata; SKILL.md does not clearly document reading that path — if you keep credentials or config files there, be aware the skill metadata signals it may access that location. - Because this is instruction-only, there is no installer action on your machine, but the agent will make network calls autonomously when invoked. If you are concerned about automatic network access, avoid invoking the skill or restrict tokens. If you want, I can list the exact API calls the SKILL.md will make and the headers/fields it will send so you can review them before proceeding.

Like a lobster shell, security has layers — review code before you run it.

latestvk970fkfyqeaq4ccjk3hc4r9cfx84261k

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments