v1.0.0

Video Editing In Ai Free

BenignClawScan verdict for this skill. Analyzed Apr 30, 2026, 11:10 PM.

Analysis

This is an instruction-only cloud video editing skill; the main thing to understand is that your videos and prompts are sent to NemoVideo using a token, and free-tier limits may apply.

GuidanceBefore installing, make sure you are comfortable sending your videos, audio, images, and editing prompts to the NemoVideo cloud service. Protect NEMO_TOKEN, verify the publisher/domain if the footage is sensitive, and check credit or upgrade requirements before starting large edits or exports.

Findings (8)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agent Goal Hijack

SeverityLowConfidenceHighStatusNote

SKILL.md

On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".

This directs the agent to initiate provider setup as the first action when the skill is used. It is aligned with the cloud-editing purpose, but it can cause an automatic network/session action before detailed user discussion.

User impactInvoking the skill may create a NemoVideo API session even before a specific video edit is performed.

RecommendationUse the skill only when you are ready to connect to the provider, and give explicit instructions before uploading or exporting any media.

Tool Misuse and Exploitation

SeverityMediumConfidenceHighStatusNote

SKILL.md

`/api/upload-video/nemo_agent/me/<sid>` | POST | Upload a file (multipart) or URL. ... `/api/render/proxy/lambda` | POST | Start export.

The skill gives the agent provider API actions that can upload media and start cloud render jobs. These actions are central to the stated purpose, but they can move user files off-device and consume service credits.

User impactYour media may be uploaded to the cloud and render jobs may use available credits when you ask the skill to edit or export.

RecommendationConfirm which file is being uploaded and when export should start, especially for sensitive videos or limited-credit accounts.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

metadata

Source: unknown; Homepage: none

The provided metadata does not identify an official source or homepage for the skill. There is no installable code here, but provenance is still relevant because the skill relies on a third-party cloud video service.

User impactYou have less information for verifying who published the skill or whether the referenced service is the intended provider.

RecommendationVerify the publisher and NemoVideo domain before uploading sensitive or private footage.

Cascading Failures

SeverityLowConfidenceMediumStatusNote

SKILL.md

Each export job queues on a cloud GPU node ... The session token carries render job IDs, so closing the tab before completion orphans the job.

Export requests can create remote render jobs that continue outside the immediate chat flow. This is normal for cloud rendering, but a mistaken upload/export can propagate into a queued job or credit usage.

User impactAn unintended render could continue or become orphaned if the session is interrupted.

RecommendationStart exports deliberately and check job status before closing the session when processing important or private media.

Human-Agent Trust Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

displayName: "Video Editing in AI Free — Edit and Export Videos Free" ... `402` | Free plan export blocked | ... "Register or upgrade your plan to unlock export."

The skill marketing emphasizes free editing/export, while the instructions also disclose credits, expiry, and possible upgrade requirements. This is not hidden, but users should understand the free tier may have limits.

User impactYou may encounter registration, credit, or upgrade requirements after starting a project.

RecommendationReview the credit and export limits before uploading large or sensitive files.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

`requires`: {"env": ["NEMO_TOKEN"]} ... All requests must include: `Authorization: Bearer <NEMO_TOKEN>`

The skill requires a service token and uses it as Bearer authentication for all provider requests. This is expected for the NemoVideo integration and there is no artifact evidence of unrelated credential use.

User impactAnyone with the token could potentially access the associated NemoVideo session or credits.

RecommendationKeep NEMO_TOKEN private, avoid pasting it into chat, and rotate or revoke it if it is exposed.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityMediumConfidenceHighStatusNote

SKILL.md

Save `session_id` from the response. ... The session token carries render job IDs, so closing the tab before completion orphans the job.

The workflow depends on server-side session state and render job identifiers. This is expected for cloud editing, but session state can persist beyond a single message and should be treated as sensitive workflow context.

User impactProject state, render jobs, and possibly media-related metadata may remain associated with the session after interactions.

RecommendationAvoid uploading highly sensitive footage unless you trust the provider, and do not share session IDs or tokens.

Insecure Inter-Agent Communication

SeverityMediumConfidenceHighStatusNote

SKILL.md

This tool takes your raw video footage and runs AI video editing through a cloud rendering pipeline. You upload, describe what you want, and download the result.

The skill communicates with an external provider API and sends user media and editing prompts to that provider. The cloud flow is disclosed and purpose-aligned, but it is still a sensitive data transfer.

User impactVideos, images, audio, prompts, and platform attribution headers may be transmitted to NemoVideo for processing.

RecommendationOnly upload media you are comfortable processing through that cloud service, and review the provider's privacy and retention terms if available.