ClawHub

Lip Sync Video

v1.0.0

Turn raw footage into polished lip-sync-video content where every word lands exactly when mouths move. This skill analyzes audio waveforms alongside facial m...

⭐ 0· 37·0 current·0 all-time
by@imo14reifey
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
The skill's name/description (frame-perfect lip syncing) aligns with the resources it requests: a single NEMO_TOKEN to call a remote nemovideo API. Nothing else (no unrelated cloud credentials or system-level access) is requested. One minor telemetry detail: the instructions say to detect the install path to populate an X-Skill-Platform header — this is not necessary for core functionality and may reveal the agent's install location.
ℹ
Instruction Scope
SKILL.md instructs the agent to check for NEMO_TOKEN, optionally obtain an anonymous token by calling the nemovideo auth endpoint, create sessions, upload user video/audio files, and request renders from the remote API. All network calls are to the declared backend (mega-api-prod.nemovideo.ai), which is consistent with the skill's purpose, but the instructions will cause user media to be transmitted off-device—this has privacy implications. The file does not instruct reading unrelated system files or other environment variables beyond NEMO_TOKEN and install-path detection.
✓
Install Mechanism
Instruction-only skill with no install spec or code files; nothing is written to disk by an installer. This is the lowest-risk install posture.
✓
Credentials
Only one environment variable (NEMO_TOKEN) is declared as required and is the primary credential; the skill also documents a flow to obtain an anonymous token if none is present. No unrelated secrets or multiple disparate credentials are requested.
✓
Persistence & Privilege
The skill is not always-enabled and does not request system-wide persistence. It retains session_id for the remote session (expected for a cloud-backed job) but does not instruct modification of other skills or global agent settings.
Assessment
This skill legitimately uploads your video/audio to a remote service (mega-api-prod.nemovideo.ai) and requires a NEMO_TOKEN (or will request an anonymous token automatically). Before installing or using it, verify you trust that external service and its privacy/terms if you will upload sensitive or proprietary footage. Prefer using the anonymous token flow (short-lived) rather than providing a long-lived personal token, and avoid uploading personally identifiable information unless you accept the external processing risk. If you are concerned about metadata leakage, note the skill also infers an X-Skill-Platform header by checking install paths — ask the skill not to send that header or sanitize it. Finally, because this is instruction-only with no install scripts, risk from local code execution is low, but network exfiltration of uploaded media is an expected behavior of this skill and should guide your decision.

Like a lobster shell, security has layers — review code before you run it.

latestvk97caazbxa3a3tf63a27dkgkz98408j6

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎤 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments