Video Caption Generator Free Ab2o 0330
v1.0.0Tell me what you need and I'll generate accurate captions for your video — no subscriptions, no hidden fees. This video-caption-generator-free skill automati...
⭐ 0· 52·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description promise automated transcription/subtitle outputs and the skill only requests a single service credential (NEMO_TOKEN) and a small per-user config path (~/.config/nemovideo/) — these are proportionate and expected for a third-party captioning backend.
Instruction Scope
Instructions are focused on connecting to the NemoVideo API, uploading files/URLs, creating sessions, and returning SRT/burned-in videos. Two items to watch: (1) the skill tells the agent not to display raw tokens but also constructs a claim URL that embeds the token as a query parameter (https://nemovideo.com/workspace/claim?token=$TOKEN...) which can leak the token via browser history/server logs; (2) the skill suggests detecting the platform by inspecting install paths (e.g., ~/.clawhub/, ~/.cursor/skills/), which requires reading filesystem locations outside the skill’s own folder. These are plausible for the feature but have privacy implications.
Install Mechanism
Instruction-only skill with no install spec and no code files — nothing is written to disk by an installer. Runtime does write a small client_id file (~/.config/nemovideo/client_id) for rate-limiting, which is reasonable for this service.
Credentials
Only a single credential (NEMO_TOKEN) is declared as required, which aligns with the described API usage. The skill will request an anonymous short-lived token if none is present; it will store a client_id and a session_id for requests. The practice of embedding tokens in shareable URLs is disproportionate from a privacy perspective and may expose credentials.
Persistence & Privilege
The skill does not request always:true or system-wide privileges. It writes a per-user client_id and keeps session state for the service — typical for a service-backed skill. It does not modify other skills or global agent configuration.
Assessment
This skill appears to do what it says (use NemoVideo to transcribe and subtitle videos), but review these points before installing: 1) The skill will use or obtain a NEMO_TOKEN and store a client_id file under ~/.config/nemovideo/; consider whether you are comfortable storing service tokens and a client identifier on the machine. 2) The instructions recommend building a claim URL that embeds the token as a query parameter — avoid using or sharing that URL if you care about token secrecy because tokens in URLs can be logged and leaked. 3) The skill may read common install paths to detect platform (it checks ~/.clawhub and ~/.cursor), which requires filesystem reads beyond the skill folder; if you want to limit that, ask the skill author to use only its own directory or provide an explicit platform field. 4) Confirm the API domain (mega-api-prod.nemovideo.ai / nemovideo.com) is the official service you intend to use and review their privacy/terms (uploads may be persisted server-side). 5) If possible, use a scoped or short-lived token and rotate/revoke tokens after use. If you need tighter guarantees (no tokens written to disk, no URLs with embedded tokens), request code or documentation changes from the author before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk972amw5rzsw7y984e6j9dxz4h83wzrv
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN