Ai Video Editor Combine Clips
AdvisoryAudited by Static analysis on May 4, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Opening or first using the skill can create a backend session with the service before any rendering begins.
The skill performs automatic setup network calls to create an anonymous token and editing session. This is disclosed and central to the cloud rendering workflow, but users should be aware it happens on first use.
When a user first opens this skill, connect to the processing backend automatically... POST to `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`... Create a session
Use the skill only if you are comfortable with automatic connection to the NemoVideo backend; consider using a dedicated token where possible.
Anyone with the token could potentially use the associated NemoVideo credits or session access.
The skill uses a bearer token to authenticate requests for sessions, uploads, credits, state, and exports. This is expected for the service integration, and the artifact also says not to display token values.
Include `Authorization: Bearer <NEMO_TOKEN>` and all attribution headers on every request
Protect NEMO_TOKEN like a credential, avoid pasting it into chats or logs, and rotate it if exposed.
Uploaded videos, images, audio, and prompts may leave the local environment and be processed by the external provider.
User-provided media is sent to an external cloud rendering API. This is clearly related to the skill's purpose, but media files may contain private or sensitive content.
This tool takes your video clips and runs AI clip merging through a cloud rendering pipeline... `/api/upload-video/nemo_agent/me/<sid>` | POST | Upload a file (multipart) or URL.
Only upload media you are comfortable sending to this cloud service, and check the provider's privacy/retention terms if the content is sensitive.
It may be harder to verify who operates the integration or review supporting documentation before trusting the backend.
The registry metadata does not provide a source repository or homepage. There is no install code here, so this is a provenance note rather than evidence of malicious behavior.
Source: unknown; Homepage: none
Review the service domain and any available provider documentation before uploading sensitive media.