Video Editing With Fast

The skill's name/description (cloud video editing) aligns with its runtime instructions and the single declared credential (NEMO_TOKEN). Requiring a token for a cloud render API is expected and no unrelated credentials or binaries are requested.

The SKILL.md explicitly instructs the agent to obtain an anonymous token if NEMO_TOKEN is not present, create a session, upload user files (multipart or URL), use SSE for edits, and poll for render results — all consistent with a remote editing service. It also instructs reading this file's frontmatter and detecting an install path (~/.clawhub/ or ~/.cursor/skills/) for attribution headers. These runtime actions require network access and the ability to read the skill file and detect installation location; that's reasonable but worth noting. There is a minor inconsistency: the registry metadata lists no required config paths, while the SKILL.md frontmatter mentions ~/.config/nemovideo/.

No install spec and no code files are present (instruction-only), so nothing is downloaded or written to disk by an installer. This is lower risk than an installable package.

Only one environment credential is declared (NEMO_TOKEN), which is appropriate for a remote editing API. The instructions also support generating an anonymous token if none is set; no unrelated secrets (AWS, GitHub, etc.) are requested.

always:false (default) and autonomous invocation is allowed (expected). The skill asks to 'store the returned session_id for all subsequent requests' and to use the token for authenticated API calls — this implies ephemeral or short-lived storage but does not require permanent, system-wide privileges. Consider verifying whether tokens/session IDs will be persisted to disk and where.