Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Youtube Free Youtube Video
v1.0.0Turn a 10-minute YouTube video URL into 1080p edited YouTube videos just by typing what you need. Whether it's editing and exporting YouTube videos for free...
⭐ 0· 34·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill claims to perform remote AI video edits and all required resources map to that: it requires a NEMO_TOKEN and documents API endpoints at mega-api-prod.nemovideo.ai for session creation, uploads, SSE edits, and export. There are no unrelated credentials, binaries, or packages requested.
Instruction Scope
SKILL.md contains explicit API interactions (anonymous-token creation, session creation, upload endpoints, render/export workflow) and describes how to handle SSE and responses. All instructed actions (uploading video files or URLs, posting edits, polling renders) are within the expected scope of a remote video-editing service. It does instruct the agent to create and store session_id and to include attribution headers, and to upload local files when the user provides them — these are expected for the stated functionality.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing is written to disk by an installer. That is the lowest-risk install posture and is proportionate for this capability.
Credentials
Only a single credential (NEMO_TOKEN) is declared and used for Bearer authentication against the documented nemovideo.ai APIs. The skill also documents generating an anonymous token if NEMO_TOKEN isn't provided. No unrelated secrets or many env variables are requested.
Persistence & Privilege
The skill is not marked always:true and does not request system-wide changes. It does reference a config path (~/.config/nemovideo/) in metadata (likely for local token/config detection), which is reasonable for a client that can reuse stored credentials.
Assessment
This skill sends your video files or video URLs to an external service (mega-api-prod.nemovideo.ai) for processing. If your video contains sensitive or private content, do not upload it. You can set NEMO_TOKEN as an environment variable if you have an account; otherwise the skill will request an anonymous token from the provider (temporary credits). Verify the domain and provider are trustworthy and review their privacy/retention policy before use. The skill will include attribution headers derived from its metadata and may read the indicated config path to locate local credentials; if you are uncomfortable, do not install or provide files. Lastly, avoid pasting secrets into prompts and consider removing any temporary tokens after use.Like a lobster shell, security has layers — review code before you run it.
latestvk979cax8b2827sv8f91pswf6bx84n97z
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
▶️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN