Video Editing With Chromebook

• Risk level: Low
• Analyzed: Apr 23, 2026, 5:07 AM
• Findings: 0
• Version: 1.0.0

Overview

The skill's requirements and runtime instructions are consistent with a remote video-editing API: it only needs a NEMO_TOKEN and instructs uploading files and calling that service — nothing in the manifest indicates hidden capabilities, though there are minor metadata inconsistencies you should double-check.

This skill appears to do what it says: call a remote video-editing API, upload your clips, and return rendered MP4s. Before installing: 1) Understand that uploaded videos are sent to https://mega-api-prod.nemovideo.ai — do not upload sensitive or private footage unless you trust the service and have reviewed its privacy policy. 2) NEMO_TOKEN is an API bearer token; treat it like a password — only provide a token with the minimal necessary scope and revoke it if you stop using the skill. 3) Ask the skill author to clarify the config-path mention (~/.config/nemovideo/) and why the agent must detect its install path for headers; this is a minor inconsistency but worth confirming. 4) If you prefer not to supply a long-lived token, the skill's anonymous-token flow is available but provides limited credits and temporary access. If any behavior beyond uploading files and calling the documented API appears (e.g., reading other files, accessing unrelated env vars, or altering other skills), stop and revoke tokens.