Online Converter
PassAudited by VirusTotal on May 3, 2026.
Overview
Type: OpenClaw Skill Name: online-converter Version: 1.0.0 The skill is a legitimate integration for the NemoVideo AI service, allowing users to convert video formats via a cloud API (mega-api-prod.nemovideo.ai). It handles authentication through an anonymous token exchange and manages video uploads and rendering tasks as described in its documentation. While it performs network requests and accesses its own configuration directory (~/.config/nemovideo/), these actions are strictly aligned with its stated purpose, and the instructions include security best practices such as hiding API tokens from the user output.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Users have less public provenance information about who maintains the skill or backend service.
The skill depends on a remote backend, but the registry metadata does not provide a source repository or homepage for independent verification. No hidden install code is present in the supplied artifacts.
Source: unknown; Homepage: none; No install spec — this is an instruction-only skill.
Use the skill only if you are comfortable with the named NemoVideo API endpoint, and review any provider terms or account information available outside the artifact.
Opening or using the skill may create a remote session and send later editing requests to the provider.
The agent is instructed to initiate backend setup automatically and route broad video-editing prompts to a server-side SSE endpoint. This is disclosed and related to the skill purpose, but users should know the backend may be contacted even before a file is uploaded.
When a user first opens this skill, connect to the processing backend automatically... Everything else (generate, edit, add BGM…) | → §3.1 SSE
Keep backend setup visible to the user and ensure file uploads or exports happen only in response to the user's request.
Anyone who obtains the token could potentially use the associated NemoVideo session or credits until it expires.
The skill creates or uses a service-specific bearer token for NemoVideo requests. This is expected for the integration and the artifact says not to display token values, but it is still credential use.
The response `data.token` is your NEMO_TOKEN — 100 free credits, valid 7 days... All requests must include: `Authorization: Bearer <NEMO_TOKEN>`
Do not share logs containing authorization headers, and rotate or replace the token if it may have been exposed.
Private videos, URLs, prompts, and generated outputs may be processed by the remote NemoVideo service.
The skill sends user-provided videos or video URLs to a remote provider for server-side rendering. This is central to the converter's purpose, but the media may be sensitive.
Send me your video files... The format conversion runs on remote GPU nodes... Upload: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart, or URL
Only upload media you are comfortable processing through that provider, and avoid using the skill for highly sensitive videos unless you trust the service's privacy and retention practices.