ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Best Ai Video Editor Free

v1.0.0

Tell me what kind of videos you make and I'll help you find and use the best-ai-video-editor-free options available today. Whether you're editing short-form...

⭐ 0· 35·0 current·0 all-time
by@dsewell-583h0
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
✓
Purpose & Capability
The skill's name/description (finding free AI video editors and routing editing work to a cloud backend) matches the runtime instructions: it requires an API token (NEMO_TOKEN), creates sessions, uploads video files, and calls nemovideo.ai endpoints. Requiring a service token and cloud APIs is expected for this purpose.
ℹ
Instruction Scope
SKILL.md instructs the agent to obtain/use NEMO_TOKEN, create sessions, stream SSE responses, upload local files (multipart or by URL), query credits/state, and render/export via the nemovideo.ai API — all within the stated editing workflow. Two items to note: (1) it derives X-Skill-Platform by detecting install paths (examining ~/.clawhub/ or ~/.cursor/skills/), which requires checking the filesystem; (2) it instructs generating/storing an anonymous token if NEMO_TOKEN is absent. The instructions do not request unrelated system secrets, but they do involve reading/writing session/token state and reading install paths.
✓
Install Mechanism
Instruction-only skill with no install spec or code files. This is the lowest-risk installation model (nothing is downloaded or written by an installer).
ℹ
Credentials
Only a single credential (NEMO_TOKEN) is declared as required, which is proportionate for a cloud-based editor. However the metadata includes a config path (~/.config/nemovideo/) and the instructions describe generating and saving an anonymous token — you should confirm where tokens/session IDs will be persisted and whether the skill will read that config directory (which could contain other data).
✓
Persistence & Privilege
always:false and normal autonomous invocation settings. The skill asks to save session_id and may persist an anonymous token for 7 days, which is reasonable for a session-based service, but this persistence should be made explicit to users (where it's stored, how to revoke).
What to consider before installing
This skill is largely coherent with its stated purpose, but there are a few things to check before installing or using it: - Provenance: the skill has no homepage and an unknown source/owner — prefer skills with a clear project page or vendor so you can inspect privacy and security policies. - Network & data flow: the skill will call https://mega-api-prod.nemovideo.ai and can upload local video files. Do not send sensitive or private footage until you trust the service and understand its retention/policy. - Tokens & persistence: the skill expects a NEMO_TOKEN and can create an anonymous token (100 credits, 7-day expiry). Ask where tokens and session IDs are stored (it references ~/.config/nemovideo/) and how to revoke/remove them. - Filesystem access: the runtime will detect install paths and may read/write config under your home dir; confirm what it reads/writes. If you proceed, test with non-sensitive sample videos first, confirm where credentials/sessions are stored, and request the maintainer's homepage/privacy policy or source code for further review.

Like a lobster shell, security has layers — review code before you run it.

latestvk971frh92thkkpy2fajyxranax843h09

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments