Video Subtitle Maker
v1.0.0Need to adding subtitles to YouTube and social media videos? This video-subtitle-maker skill handles AI subtitle generation on a remote backend — just upload...
⭐ 0· 91·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match the actual behavior: the skill uploads video files to a remote backend and manages sessions, uploads, SSE, and final export. The single required credential (NEMO_TOKEN) is appropriate for a remote API. However, the SKILL.md frontmatter references a config path (~/.config/nemovideo/) that is not declared in the registry 'Requirements' summary — this mismatch should be resolved (either the skill expects to read that config directory or it does not).
Instruction Scope
The instructions focus on connecting to the external nemo backend, creating/using a token, creating a session, uploading videos, streaming SSE messages, polling render status, and downloading results. There are no instructions that ask the agent to read unrelated system files, arbitrary credentials, or transmit data to unexpected endpoints. The only out-of-band item is the frontmatter's mention of the local config path and a directive to auto-detect 'install path' for X-Skill-Platform — both are minor scope creep and should be clarified.
Install Mechanism
This is an instruction-only skill with no install spec and no code files. That is the lowest-risk install model: nothing is written to disk by the skill itself.
Credentials
The skill requires a single credential, NEMO_TOKEN, which is appropriate for an API-backed subtitle service. The SKILL.md describes generating an anonymous token if none is present. The earlier registry summary reported no required config paths but SKILL.md/frontmatter references ~/.config/nemovideo/ — requesting access to that config directory would increase privileges and should be justified. Otherwise, no unrelated credentials are requested.
Persistence & Privilege
The skill does not request 'always: true' or elevated platform privileges and has no install-time persistence. It only asks to create/use short-lived sessions on the remote service; this is proportionate for its purpose.
Assessment
This skill appears to do what it says: it uploads videos to a remote rendering backend (https://mega-api-prod.nemovideo.ai) and uses a single API token (NEMO_TOKEN). Before installing, consider: 1) Data privacy — your videos (and any spoken content) will be uploaded to an external service; avoid uploading sensitive content until you confirm the provider's privacy/retention policy. 2) Token safety — treat NEMO_TOKEN like a password; provide a scoped or disposable token when possible and rotate/revoke it if you stop using the skill. 3) Metadata mismatch — SKILL.md references ~/.config/nemovideo/ and the registry metadata disagrees; ask the author whether the skill will read local config files. 4) Unknown source — there is no homepage or known owner; prefer skills that link to a project or vendor page. 5) Test safely — try a short, non-sensitive clip first to confirm behavior. If you need higher assurance, ask the publisher for source code or a privacy/terms link and verify the nemovideo.ai endpoints and TLS certificates.Like a lobster shell, security has layers — review code before you run it.
latestvk973rg6tw06bv2skjr7yc37gch84ga23
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
💬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN