ClawHub

Documentary Video Maker

v1.2.3

Create professional documentaries and docu-style content with AI — produce complete documentary projects from raw interview footage, archival material, B-rol...

⭐ 0· 139·0 current·0 all-time
by@imo14reifey
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description describe an API-backed media processing service. Declared requirements (NEMO_TOKEN, ~/.config/nemovideo/) and the apiDomain (mega-api-prod.nemovideo.ai) align with that purpose; there are no unrelated env vars or binaries requested.
ℹ
Instruction Scope
This is an instruction-only skill that will necessarily instruct the agent to collect and upload user media (interviews, photos, B-roll) to NemoVideo for processing — that behavior is consistent with the stated purpose. I reviewed the provided portion of SKILL.md and saw no instructions to access unrelated system files or credentials, but the SKILL.md was truncated in the bundle preview; confirm the remainder does not instruct reading other config directories, shell history, or sending data to endpoints outside the declared apiDomain.
✓
Install Mechanism
No install spec and no code files — lowest-risk footprint. The skill is instruction-only and does not pull binaries or run install scripts.
✓
Credentials
Only a single credential (NEMO_TOKEN) and a service config path are declared, which is proportionate for a hosted media-processing API. No additional unrelated secrets or broad filesystem credentials are requested.
✓
Persistence & Privilege
always is false and the skill is user-invocable; it does not request permanent elevated presence. Nothing indicates it would modify other skills or system-wide settings.
Assessment
This skill appears coherent for a cloud-based documentary production service: it needs a NemoVideo API token (NEMO_TOKEN) and will upload your media to the vendor's API. Before installing: (1) Verify the provider (confirm nemovideo.com and the GitHub repo are legitimate and owned by the expected organization). (2) Review NemoVideo’s privacy, retention, and security practices — understand how long uploads are stored, whether they are encrypted at rest/in transit, and who can access them. (3) Don’t upload sensitive personal data or third-party interviews without consent. (4) Treat NEMO_TOKEN as a secret: only grant a token with the minimal scope needed, rotate it if you suspect compromise, and check what gets stored under ~/.config/nemovideo/ (it may persist the token). (5) Inspect the full SKILL.md (the preview was truncated) and any linked code/repo for instructions that send data to other endpoints or read unrelated local files; if you find requests for additional secrets or broad filesystem access, reconsider installation. If you need higher assurance, test the skill with non-sensitive sample footage first.

Like a lobster shell, security has layers — review code before you run it.

latestvk971engjpsxkyhcvp5k26n4ny184cr16

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎥 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments