Video Editing With Claude

PassAudited by ClawScan on May 10, 2026.

Overview

This is a coherent cloud video-editing skill, but it will connect to NemoVideo, use or create a service token, upload selected media, and run cloud render jobs.

Install only if you are comfortable sending selected video/audio/image files to NemoVideo’s cloud API. Use a dedicated token if possible, avoid uploading sensitive footage, and ask for confirmation before export if credit usage matters.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Raw footage you provide may be uploaded to NemoVideo, and export jobs may consume service credits.

Why it was flagged

The skill is explicitly designed to call external upload and render endpoints. This is expected for cloud video editing, but it means selected videos and export actions leave the local environment and are handled by a third-party service.

Skill content
All calls go to `https://mega-api-prod.nemovideo.ai`. The main endpoints: ... **Upload** ... **Export** — `POST /api/render/proxy/lambda` ...
Recommendation

Only provide media you intend to send to the cloud service, and confirm export/credit usage when working with important or private footage.

What this means

The skill can act under the NemoVideo token available in your environment or under an anonymous token it obtains.

Why it was flagged

The skill uses a bearer token for the NemoVideo API or generates an anonymous token. This is normal for the service integration, and the artifact also says not to print tokens.

Skill content
**Token**: If `NEMO_TOKEN` environment variable is already set, use it ... **Free token**: Generate a UUID ... `data.token` becomes your NEMO_TOKEN ... Include `Authorization: Bearer <NEMO_TOKEN>` ... on every request
Recommendation

Use a dedicated token when possible, avoid sharing logs containing credentials, and monitor account credits if using a paid or persistent token.

What this means

Project state and media metadata may remain available to the cloud service during the editing session.

Why it was flagged

The workflow stores and reuses server-side session, draft, and media state. This is expected for multi-step video editing, but it is persistent context held by the provider during the session.

Skill content
**Session**: POST ... Save `session_id` from the response ... **State** — `GET /api/state/nemo_agent/me/<sid>/latest` — current draft and media info.
Recommendation

Avoid uploading highly sensitive media unless you trust the provider’s retention and deletion practices.

NoteMedium Confidence
ASI10: Rogue Agents
What this means

A cloud render may keep running briefly even if you stop watching the session.

Why it was flagged

Render jobs can continue on the provider after the user closes the tab, and the workflow includes repeated polling. This is purpose-aligned for cloud rendering but is worth user awareness.

Skill content
The session token carries render job IDs, so closing the tab before completion orphans the job ... Poll `GET /api/render/proxy/lambda/<id>` every 30s for `completed` status
Recommendation

Check job status and credits after starting exports, especially for longer videos.

NoteMedium Confidence
ASI01: Agent Goal Hijack
What this means

Provider responses may cause the agent to take additional in-service actions such as checking state or starting export.

Why it was flagged

The skill asks the agent to translate backend GUI-style responses into API actions. This appears limited to the stated video-editing service, but it means remote service responses can influence follow-on actions.

Skill content
The backend responds as if there's a visual interface. Map its instructions to API calls: ... "click" ... → execute the action via the relevant endpoint ... "Export" ... → run the export workflow
Recommendation

Ask the agent to confirm before exporting or making credit-consuming changes if you want tighter control.