Video Editor In Free

PassAudited by ClawScan on May 10, 2026.

Overview

This is a coherent cloud video-editing skill, but it uses a Nemo bearer token and sends selected media to an external backend for processing.

Install only if you are comfortable using nemovideo.ai as a cloud processor for your media. Keep NEMO_TOKEN private, confirm exports before spending credits, and avoid uploading confidential videos unless you have independently reviewed the provider's privacy and retention terms.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may perform editing or export steps through the provider API based on the service workflow, which could consume credits or create downloadable render outputs.

Why it was flagged

The skill lets backend responses drive API actions inside the editing service. This is expected for the advertised cloud editor, but exports and similar actions should stay aligned with the user's request.

Skill content
Backend says "click [button]" / "点击" | Execute via API ... "Export button" / "导出" | Execute export workflow
Recommendation

Confirm before exporting or spending credits, and review the final video/download URL before sharing it.

What this means

Anyone with the token could access the associated Nemo credits/session, so the token should be treated like a credential.

Why it was flagged

The skill uses a bearer token for Nemo API sessions and credits. This is purpose-aligned authentication, and the artifacts do not show token logging or unrelated credential use.

Skill content
All requests must include: `Authorization: Bearer <NEMO_TOKEN>` ... `Obtain a free token` ... `data.token` is your NEMO_TOKEN
Recommendation

Use a dedicated token, avoid sharing logs that contain authorization headers, and rotate the token if it may have been exposed.

What this means

Users have less information for checking who operates the backend or what privacy/service terms apply.

Why it was flagged

There is no local code install path, but the registry metadata does not provide a source repository or homepage to independently verify the skill/provider provenance.

Skill content
Source: unknown; Homepage: none ... No install spec — this is an instruction-only skill.
Recommendation

Verify the provider and terms separately before uploading confidential or sensitive videos.

What this means

Uploaded videos, images, audio, and related project data are processed outside the local environment.

Why it was flagged

The skill explicitly sends user-selected media to an external provider API for cloud processing. That data flow is central to the stated video-editing purpose.

Skill content
All calls go to `https://mega-api-prod.nemovideo.ai` ... `Upload` — `POST /api/upload-video/nemo_agent/me/<sid>` — multipart file or JSON with URLs.
Recommendation

Only upload media you are comfortable sending to nemovideo.ai, and avoid private or regulated footage unless the provider's privacy and retention practices are acceptable.