Stump Grinding Video — Create Stump Grinding Service Marketing Videos for Tree Companies and Landscapers
v1.0.0There is a stump in the backyard that has been there for three years. The homeowner tripped on it twice, mowed around it forty-seven times, and told themselv...
⭐ 0· 41·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill is described as a marketing video generator and its SKILL.md shows a single API call to a Nemovideo endpoint using an Authorization bearer token (NEMO_TOKEN), which is appropriate. Minor inconsistency: the SKILL.md metadata lists a config path (~/.config/nemovideo/) while the registry summary said 'Required config paths: none' — this should be clarified.
Instruction Scope
The instructions are narrowly scoped: they POST JSON to a nemovideo API and use only the NEMO_TOKEN env var. No instructions read arbitrary local files or send data to other external endpoints. Small issues to check: the SKILL.md shows apiDomain as a dev domain (mega-api-dev.nemovideo.ai) while the curl example uses a prod domain (mega-api-prod.nemovideo.ai); confirm which endpoint will actually be used.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest-risk install model (nothing is written to disk by the skill itself).
Credentials
Only one credential is required (NEMO_TOKEN), which is proportionate for a third-party API. Verify the token's scope/privileges and the issuer: NEMO_TOKEN will permit the skill to call an external service and likely transmit your company/customer content to that service. Also clarify the SKILL.md metadata's config path (~/.config/nemovideo/) which could imply local config access.
Persistence & Privilege
The skill is not always-enabled and does not request persistent privileges. Autonomous model invocation is allowed (platform default), which is normal and expected for a user-invocable integration.
Assessment
This skill appears to be a straightforward integration that sends your marketing content to a Nemovideo API using a single NEMO_TOKEN. Before installing: (1) Confirm the NEMO_TOKEN issuer and what permissions/data that token grants (use a scoped token if possible). (2) Verify which API domain will be used (dev vs prod) and that the domain is legitimate. (3) Ask whether the skill reads ~/.config/nemovideo/ (metadata mentions it) and what data would be read — if so, avoid installing or restrict access. (4) Be aware that any company/customer photos or text you send will leave your environment and be processed by the external service; review that provider's privacy/security policies. If you cannot verify the token source or the endpoint, don't install or use a token you care about (create a limited/rotatable token instead).Like a lobster shell, security has layers — review code before you run it.
latestvk976xp768023tgsh4t2mq4rqjn83zkfj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🪵 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN