ClawHub

Ai Subtitle Generator

v10.0.1

You just finished a thirty-minute interview with a founder who switches between English and Mandarin mid-sentence. Your editor needs subtitles by morning. Th...

⭐ 0· 334·0 current·0 all-time
by@imo14reifey
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
ℹ
Purpose & Capability
The SKILL.md describes a cloud-based subtitling/transcription service (NemoVideo) which legitimately requires an API token and may read its local config (~/.config/nemovideo/). That aligns with the skill's purpose. However, the registry summary lists no required env vars/config paths while the SKILL.md metadata declares primaryEnv: NEMO_TOKEN and a configPaths entry — an inconsistency in the manifest that should be clarified.
✓
Instruction Scope
The visible instructions are focused on transcription, timing, speaker ID, translation and exporting subtitle files. As an instruction-only skill, its runtime actions are likely to upload user audio/video to the NemoVideo service and read local NemoVideo config. No instructions in the excerpt ask for unrelated system data. You should still confirm the full SKILL.md to see exactly what files/paths are read and what network endpoints are used.
✓
Install Mechanism
No install spec or code files are present — lowest-risk deployment model. Nothing will be written to disk by an installer. The runtime risk comes from uploads to an external service (expected for this use case), not from installation.
ℹ
Credentials
Requesting a single API credential (NEMO_TOKEN) is proportionate for a third‑party transcription service. But registry metadata and SKILL.md disagree: registry shows no required env vars/config paths while SKILL.md declares a primaryEnv and a config path (~/.config/nemovideo/). Confirm whether the skill will read that local config and whether NEMO_TOKEN must be set as an env var or comes from the config file. Ensure the token is least-privileged and rotate/revoke if misused.
✓
Persistence & Privilege
The skill is not always-enabled and does not request elevated or persistent platform privileges. It does not appear to modify other skills or system-wide agent settings.
Assessment
This skill appears to do what it says (upload video to NemoVideo to generate subtitles), but verify a few things before installing: 1) Confirm the exact runtime behavior by reviewing the full SKILL.md — which local files/paths it reads (the metadata references ~/.config/nemovideo/) and which network endpoints it uploads to. 2) Confirm how NEMO_TOKEN is provided (environment variable vs local config) and ensure the token has minimal scope and can be revoked. 3) Consider privacy: uploaded audio/video may contain sensitive data — review NemoVideo's data retention, processing, and deletion policies. 4) Test first with non-sensitive sample media and a limited token. 5) Ask the publisher to fix the manifest inconsistencies (registry metadata vs SKILL.md) before trusting the skill fully. Providing the full SKILL.md runtime steps or any example API calls would increase confidence in this assessment.

Like a lobster shell, security has layers — review code before you run it.

latestvk975dzdzssz9w64sjghm5he7hs83wdny

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📝 Clawdis
Primary envNEMO_TOKEN

Comments