Online Youtube Video Editor
v1.0.2The online-youtube-video-editor skill on ClawHub lets creators edit YouTube-ready videos through natural conversation — no timeline scrubbing, no steep learn...
⭐ 0· 74·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description match the runtime instructions: the SKILL.md details API calls for uploading, editing, and exporting video via the nemovideo API. Required items (NEMO_TOKEN, optional NEMO_CLIENT_ID persistence) are consistent with a hosted video-editing backend.
Instruction Scope
Instructions are focused on session creation, upload, edit, state, credits, and export endpoints. The skill reads/writes a single local path (~/.config/nemovideo/client_id) to persist a UUID and requires inclusion of X-Skill-* headers. This is within the domain of the skill but the required headers may reveal installer/platform information (see guidance). No instructions attempt to read unrelated files or other credentials.
Install Mechanism
There is no install spec and no code files — this is instruction-only. That minimizes install-time risk because nothing is written beyond the documented client_id file.
Credentials
The primary credential requested is NEMO_TOKEN (service API token) which is appropriate. Other env vars listed are optional defaults. The skill persists a non-secret client_id in ~/.config/nemovideo/ which is proportionate. One minor inconsistency: metadata declares NEMO_TOKEN as required while the user-facing table marks it as 'No' (auto-generated).
Persistence & Privilege
always:false and user-invocable:true (default) — no elevated permanence. The only persistent artifact is a client_id UUID file under the user's config directory; the skill does not request system-wide config changes or other skills' credentials.
Assessment
This skill appears coherent for remote video editing, but review the following before installing:
- NEMO_TOKEN: The skill uses an API token. It can be auto-requested (anonymous token) or you can supply your own. Treat that token like any API credential — avoid sharing it and revoke it if you suspect misuse.
- Local file: The skill will create ~/.config/nemovideo/client_id containing a UUID to avoid rate limits. This is non-secret but persistent. If you don't want files written, create that file yourself or empty the directory after use.
- Headers may leak context: The SKILL.md requires X-Skill-Source/X-Skill-Version/X-Skill-Platform headers. X-Skill-Platform may be inferred from the skill file path — this could reveal which platform or install path the skill was loaded from. If you are concerned about leaking path/platform info, set SKILL_SOURCE explicitly to a sanitized value or verify how the agent populates that header.
- Metadata mismatch: The skill metadata marks NEMO_TOKEN as required but the documentation implies it can be auto-generated — expect to receive temporary anonymous tokens (7-day expiry). Confirm the token model and limits on nemovideo.com so you understand privacy/retention and quotas.
- Privacy and trust: The skill talks to mega-api-prod.nemovideo.ai / nemovideo.com. Verify the service reputation and privacy policy before sending sensitive footage (especially private or copyrighted content).
- Operational advice: Prefer to use an account/token you can revoke, avoid sending highly sensitive footage until satisfied with the service, and check exported outputs in a sandbox before publishing.
If you want a stricter assessment, provide the full rest of the SKILL.md (truncated sections) or any additional runtime examples so I can inspect for unexpected data exfiltration or other API endpoints.Like a lobster shell, security has layers — review code before you run it.
latestvk973bhgkq0ww6rp11fa62r73gd83rqsk
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN