Back to skill
Skillv1.0.0
ClawScan security
Video Game · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousApr 28, 2026, 5:07 PM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's stated purpose (cloud AI video editing) matches most of its instructions, but there are inconsistencies and a few instructions that ask the agent to probe local paths and manage tokens in ways that weren't declared — the mismatches warrant caution before installing.
- Guidance
- This skill appears to implement remote AI video editing and only needs a NEMO_TOKEN API credential — that is sensible. Before installing, consider: (1) the skill will upload your raw video files to a third-party domain (mega-api-prod.nemovideo.ai) — confirm you are comfortable with that service and its privacy/retention policy; (2) the skill's instructions tell the agent to detect install paths (e.g., ~/.clawhub, ~/.cursor/skills) and reference ~/.config/nemovideo/ even though the registry didn't list any config paths — ask the publisher why the skill needs to probe or write local paths and where it will store tokens/session data; (3) the skill will auto-request an anonymous token if none is provided and store session state — consider network monitoring or limiting outbound access if you want to audit this behavior; (4) if you need higher assurance, ask for source code or a canonical homepage, or run the skill in a sandboxed environment; given the inconsistencies, proceed only if you trust the backend domain or after obtaining clarifications.
Review Dimensions
- Purpose & Capability
- noteThe skill claims to perform cloud video editing and requires a single API credential (NEMO_TOKEN), which is coherent with the described functionality. However, the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) in its metadata that is not declared in the registry's top-level requirements; this mismatch is unexplained.
- Instruction Scope
- concernThe runtime instructions include normal API workflows (anonymous-token acquisition, session creation, file upload, render/export polling) which are expected. Concerns: (1) instructions tell the agent to detect X-Skill-Platform from install paths (e.g., ~/.clawhub/, ~/.cursor/skills/) — that implies probing the host filesystem to determine install location, which is outside the obvious task of video editing and was not declared in the registry requirements; (2) the frontmatter references ~/.config/nemovideo/ which suggests reading/writing a local config directory though the registry reported no required config paths; (3) the skill instructs the agent to generate and persist tokens/session IDs for subsequent requests and to avoid showing raw tokens, which is normal for API clients but means the agent will create/hold credentials and session state automatically.
- Install Mechanism
- okNo install spec and no code files — instruction-only. That minimizes disk footprint and avoids downloading arbitrary binaries; this is the lower-risk install profile.
- Credentials
- noteOnly a single credential (NEMO_TOKEN) is declared as required, which matches the API-based design. However, SKILL.md describes an automatic anonymous-token acquisition flow (POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token) that will generate and return a token if NEMO_TOKEN is not set; this is functionally fine but means the skill will create/hold credentials on the user's behalf. The unadvertised ~/.config/nemovideo/ path in the skill metadata implies possible local storage of config/credentials that wasn't declared at the registry level.
- Persistence & Privilege
- okalways:false and normal autonomous invocation settings. The skill asks to store session_id/token for request continuity, which is typical. There is no request to modify other skills or system-wide settings. The only minor privilege concern is the implied local config path (~/.config/nemovideo/) which could be used to persist data if the agent follows that metadata.