Video Compressor Github
v1.0.0Get compressed MP4 files ready to post, without touching a single slider. Upload your large video files (MP4, MOV, AVI, WebM, up to 500MB), say something lik...
⭐ 0· 51·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (compress/upload videos) align with the operations described in SKILL.md: creating sessions, uploading video files, starting renders, and returning download URLs. Requiring a NEMO_TOKEN is expected for a cloud backend that uses bearer auth.
Instruction Scope
Instructions are focused on the cloud render workflow (token acquisition, session creation, upload, render, polling). They explicitly instruct the agent to look for NEMO_TOKEN and, if missing, call an anonymous-token API to obtain one. The skill also expects the agent to derive X-Skill-Platform from an install path, which implies the agent may inspect its install environment — this is reasonable but worth noting because it touches local path detection. The instructions clearly send user videos to a remote service (data exfiltration is part of intended functionality).
Install Mechanism
No install spec or code files — instruction-only skill. No downloads or archive extraction. Low install risk.
Credentials
Only one credential is requested (NEMO_TOKEN), which is proportional to interacting with the described API. The SKILL.md can also obtain an anonymous token itself via the public anonymous-token endpoint; this is logical but means the skill can create short-lived credentials without the user providing one. There is a minor inconsistency: registry summary lists no required config paths, while the SKILL.md frontmatter includes a configPaths entry (~/.config/nemovideo/).
Persistence & Privilege
always:false and no install-time persistence. The skill does not request elevated or permanent platform presence. Autonomous invocation is allowed (default) but not, by itself, a red flag here.
Assessment
This skill is coherent with a cloud video-compression service: using it will upload any video you drop into the chat to mega-api-prod.nemovideo.ai and use a NEMO_TOKEN (either one you provide or a short-lived anonymous token the skill can obtain). Before installing or invoking: 1) confirm you trust nemovideo.ai with the videos you will upload (privacy/retention concerns); 2) if you prefer control, create and supply your own NEMO_TOKEN rather than relying on anonymous token issuance; 3) note the small metadata mismatch (SKILL.md mentions ~/.config/nemovideo/ while the registry summary did not) — ask the skill author where tokens/getting-stored and whether anything is written to disk; 4) be aware the agent may inspect install paths to set X-Skill-Platform header (this is benign but accesses local path info). If any of those behaviors are unacceptable, do not install or do not upload sensitive videos.Like a lobster shell, security has layers — review code before you run it.
latestvk971tfrmsjb2sj2mcyys74rkrd84sfpw
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🗜️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN