Editor Content Creator

PassAudited by ClawScan on May 11, 2026.

Overview

This is a coherent cloud video-editing skill, but users should know it sends selected media to an external NemoVideo API and uses a provider token.

This skill appears suitable for its stated cloud video-editing purpose. Before using it, be comfortable sending selected footage to NemoVideo's cloud API and using or generating a NEMO_TOKEN for that service.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Private or unpublished media uploaded through this skill will leave the local environment and be processed by the NemoVideo service.

Why it was flagged

The skill sends user-selected video, image, or audio files to an external cloud backend for processing.

Skill content
Upload: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL: `{"urls":["<url>"],"source_type":"url"}`
Recommendation

Only upload files you are comfortable sending to that provider, and check the provider's privacy/retention terms if the content is sensitive.

What this means

The token authorizes actions against the NemoVideo backend, including uploads, session state checks, credit checks, and exports.

Why it was flagged

The skill uses a NemoVideo bearer token, or creates a temporary anonymous token, to authenticate cloud editing requests.

Skill content
Look for `NEMO_TOKEN` in the environment... POST `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`... Extract `data.token` from the response
Recommendation

Use a dedicated or temporary token where possible, avoid sharing it, and do not expose raw API responses containing credentials.

What this means

Provider responses can trigger follow-up editing or export steps during the workflow, though this is consistent with the video-editing purpose.

Why it was flagged

The skill instructs the agent to translate backend GUI-style messages into additional API actions.

Skill content
Backend Response Translation... `"click [button]" / "点击" | Execute via API` ... `"Export button" / "导出" | Execute export workflow`
Recommendation

For important projects, ask the agent to summarize planned edits and exports before performing them.

What this means

Users have limited provenance information to independently verify who maintains the skill or the associated backend.

Why it was flagged

The registry metadata does not provide a source repository or homepage for the cloud integration.

Skill content
Source: unknown; Homepage: none
Recommendation

Prefer installing only if you trust the publisher and the NemoVideo service endpoint used by the skill.