Video Overlay Creator

• Analyzed: May 6, 2026, 11:21 AM
• Findings: 1
• Version: 1.0.0
• Hash: 5e63b7e72315fd6cdf893be478bdc428b3b3acb52361300781081a24211e6ce4
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill interfaces with a cloud API (mega-api-prod.nemovideo.ai) to process videos, requiring high-risk capabilities such as local file uploads and network communication. Key indicators include instructions for the agent to automatically fetch anonymous authentication tokens if NEMO_TOKEN is missing and to fingerprint the host environment by detecting the installation path for attribution headers (X-Skill-Platform). While these behaviors are aligned with the stated purpose of cloud-based video editing, the broad file access and environment probing represent a significant attack surface without explicit constraints on file paths in SKILL.md.