Hire Youtube Video Editor
v1.0.0Tell me what your channel needs and I'll help you hire-youtube-video-editor talent that actually fits your style, budget, and upload schedule. This skill wal...
⭐ 0· 46·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill is a hiring/onboarding assistant and all network calls, headers, and the single required credential (NEMO_TOKEN) are consistent with a backend matchmaking/service API. Minor inconsistency: registry metadata lists NEMO_TOKEN as required, but SKILL.md describes obtaining an anonymous NEMO_TOKEN automatically if none is present (so the token is not strictly required up front). The declared config path (~/.config/nemovideo/) is plausible for storing token/config and matches the backend naming.
Instruction Scope
SKILL.md instructs the agent to perform network operations against https://mega-api-prod.nemovideo.ai (auth token fetch, session creation, SSE messaging, uploads, export/render calls). This stays within the hiring/editing workflow, but it does include instructions to upload user files (multipart file uploads or URLs) and to transmit session/draft data to the remote service — a reasonable capability for this skill but a clear privacy/data-exfiltration vector that users must consent to before sending media or drafts.
Install Mechanism
No install spec and no code files — this is an instruction-only skill that performs network interactions at runtime. That minimizes filesystem risk (no archive download or new binaries).
Credentials
Only one credential is declared (NEMO_TOKEN), which matches the backend usage. The skill also documents how to obtain an anonymous token if not present, so requiring the env var up front is somewhat unnecessary but not dangerous. Declared config path (~/.config/nemovideo/) is plausible. No unrelated secrets or multiple unrelated credentials are requested.
Persistence & Privilege
always is false and the skill does not request system-wide changes or other skills' configs. It stores a session_id in-memory for the session lifecycle (expected). The skill can be invoked autonomously (disable-model-invocation=false), which is the platform default; this is normal and not, by itself, a reason to block installation.
Assessment
This skill appears to do what it says: it connects to a nemo-video backend to match and manage editor hires. Before installing or using it, be aware that (1) it will send session data and any files you upload (video drafts, source files) to https://mega-api-prod.nemovideo.ai — don't upload sensitive or private material unless you trust that service and its terms; (2) the skill can obtain an anonymous token automatically, so setting a NEMO_TOKEN env var is optional — set one yourself if you prefer using your own account/token instead of the anonymous flow; (3) verify the privacy/retention policy of nemovideo.ai if you plan to upload content; and (4) the skill's metadata slightly contradicts the instructions about whether NEMO_TOKEN is required up front — this looks like a minor authoring oversight but not malicious. If you need higher assurance, ask the skill author for a privacy/data-handling statement or run the skill in an environment where you control what files can be sent (e.g., avoid uploading master files).Like a lobster shell, security has layers — review code before you run it.
latestvk974dh0fwx1c7ywsetcrh94jfs84erzz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN