Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Video Generator Free Ai Tool
v1.0.0generate text or images into ready-to-share videos with this skill. Works with MP4, MOV, JPG, PNG files up to 200MB. content creators and marketers use it fo...
⭐ 0· 14·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to generate videos via a cloud API and the SKILL.md exclusively documents network calls to mega-api-prod.nemovideo.ai and upload/ render endpoints — this aligns with the stated purpose. However, the registry metadata listed no config paths while SKILL.md frontmatter references ~/.config/nemovideo/ (inconsistency).
Instruction Scope
Instructions ask the agent to obtain or use a NEMO_TOKEN, create anonymous tokens via an external endpoint, start sessions, upload user files (up to 200MB), stream SSE, and 'save session_id' — all reasonable for a cloud video service, but the doc is vague about where tokens/session IDs should be saved (frontmatter suggests a config path). Saving tokens/session IDs implies writing persistent state to disk or agent storage; that persistence is not declared in the registry metadata. The skill does not ask the agent to read unrelated user files, but it will upload whatever the user provides to an external service — users should avoid uploading sensitive media.
Install Mechanism
No install spec or code files are present; the skill is instruction-only, which minimizes installation risk (nothing downloaded or written by an installer).
Credentials
The registry marks NEMO_TOKEN as a required env var / primary credential, but the SKILL.md explicitly documents generating an anonymous token when NEMO_TOKEN is not set, so the token appears optional. This mismatch is an incoherence: the skill should not declare NEMO_TOKEN as required if it can operate via anonymous tokens. The only credential-related I/O documented is to the video API, which is expected for this purpose.
Persistence & Privilege
always:false (normal). However, SKILL.md instructs saving session_id and may use ~/.config/nemovideo/ (frontmatter). The registry reported no required config paths; this mismatch means the skill may persist tokens/session data without that being reflected in declared requirements — ask the author where and how session/tokens are stored and rotated.
What to consider before installing
This skill appears to be a normal cloud-based video generator, but there are some inconsistencies you should resolve before installing: 1) The registry marks NEMO_TOKEN as required, yet the docs show the skill can create an anonymous token if none is set — do not provide a long-lived or high-privilege token unless necessary. 2) SKILL.md references saving session state/config at ~/.config/nemovideo/ but the registry metadata did not declare any config paths; ask where tokens/session_ids will be stored and for how long. 3) The skill will upload any files you provide to https://mega-api-prod.nemovideo.ai — do not upload sensitive images, audio, or private videos unless you verify the service's privacy policy and trustworthiness. 4) Confirm the API domain and the expected retention/processing of uploaded media (credentials, logs, and retention policy). If the vendor cannot clarify the credential and persistence details, consider treating the skill as untrusted for sensitive content.Like a lobster shell, security has layers — review code before you run it.
latestvk975ww1677tmghn6cqjnqbwa8584syb0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN