ClawHub

Arena Ai

v1.0.3

Arena-ai is a ClawHub video skill built for competitive, sports, and event footage that demands frame-accurate intelligence. It identifies key moments, crowd...

⭐ 0· 114·0 current·0 all-time
by@imo14reifey
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description match the runtime instructions: the skill routes uploads and edit/ export requests to nemovideo API endpoints, does pre-analysis of footage, and exposes conversational editing flows. The primary credential (NEMO_TOKEN) and config path (~/.config/nemovideo/) are relevant to that purpose. Minor note: registry metadata lists no required env vars while metadata/frontmatter names NEMO_TOKEN as primaryEnv (it is optional/auto-generated per docs) — this is explainable but worth noting.
✓
Instruction Scope
SKILL.md instructs the agent to (a) greet the user, (b) read/write a single client_id file at ~/.config/nemovideo/client_id, (c) request an anonymous token from the NEMO API, and (d) upload/process videos via the API. There is no instruction to read unrelated system files, credentials (e.g., SSH keys, cloud creds), or to exfiltrate arbitrary data. Important: user video files are sent to an external API — that is expected for this service but is a privacy consideration.
✓
Install Mechanism
No install spec and no code files — instruction-only skill. That keeps disk/write risk low; the only persistent write is the client_id file the skill explicitly describes. No external downloads or archive extraction are requested.
✓
Credentials
The only credential surface is NEMO_TOKEN (declared as primary). Other env vars listed in the docs (NEMO_API_URL, NEMO_WEB_URL, NEMO_CLIENT_ID, SKILL_SOURCE) are optional configuration values that match the service's needs. No unrelated secrets or multiple unrelated credentials are requested. The skill auto-generates an anonymous token if none is present, which explains why NEMO_TOKEN is not strictly required.
✓
Persistence & Privilege
always:false and normal agent invocation; the skill persists a single UUID to ~/.config/nemovideo/client_id to avoid rate-limiting. It does not request to modify other skills or system-wide settings. Persistence is limited and scoped to its own config path.
Assessment
This skill appears to do what it says, but it uploads your video files to an external service (meg a-api-prod.nemovideo.ai / nemovideo.com) and will write a small client_id file to ~/.config/nemovideo/. Before installing, decide whether you are comfortable sending the footage (especially sensitive or private content) to that service. If you want tighter control: (1) create and supply your own NEMO_TOKEN from your Nemovideo account instead of letting the skill obtain an anonymous token; (2) verify the API hostname and privacy/TOS at nemovideo.com; (3) review network activity or run the skill in an environment where you can inspect uploads; and (4) if provenance matters, ask the publisher for the full skill code/repository and review it before use.

Like a lobster shell, security has layers — review code before you run it.

latestvk972cbrrne14thw0aqdw3e6qwh83q1bn

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🏟️ Clawdis
Primary envNEMO_TOKEN

Comments