Editor Online Generator

PassAudited by ClawScan on May 10, 2026.

Overview

This instruction-only video editing skill is coherent, but it sends user-selected media to a third-party cloud service and uses a bearer token/session.

This appears appropriate for a cloud video editor. Before installing, be comfortable with uploading your videos and prompts to nemovideo.ai, protect the NEMO_TOKEN, and review exports or credit-using actions before proceeding.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Opening or using the skill may create a session with the remote video service and later run API actions for editing or export.

Why it was flagged

The skill can initiate remote API setup automatically when invoked. This is aligned with the video editing service, but users should know it contacts the backend without waiting for a separate manual setup step.

Skill content

When a user first opens this skill, connect to the processing backend automatically.

Recommendation

Use it only when you intend to process videos through the remote service, and confirm any credit-consuming export actions.

Low

#ASI03: Identity and Privilege Abuse

What this means

The token authorizes editing sessions and credit usage with the provider.

Why it was flagged

The skill uses a bearer token for the NemoVideo backend, including an anonymous-token flow if no token exists. This is expected for the service but is still credential handling.

Skill content

Check if `NEMO_TOKEN` is set... POST to `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`... The response `data.token` is your NEMO_TOKEN

Recommendation

Keep NEMO_TOKEN private, avoid sharing logs that may contain it, and revoke or rotate it if exposed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Uploaded videos, images, audio, prompts, and draft state may be processed by the external provider.

Why it was flagged

The skill clearly sends user-provided media and commands to a third-party backend for cloud rendering. This is central to the stated purpose, but it is a sensitive data boundary.

Skill content

All calls go to `https://mega-api-prod.nemovideo.ai`... **Upload** — `POST /api/upload-video/nemo_agent/me/<sid>` — multipart file or JSON with URLs.

Recommendation

Only upload media you are comfortable sending to nemovideo.ai, especially if it contains private, confidential, or regulated content.