Editor Combine
ReviewAudited by ClawScan on May 11, 2026.
Overview
This is a coherent cloud video-combining skill, but it sends uploaded media to NemoVideo and uses or creates a service token, so users should treat it as cloud processing.
This skill appears purpose-aligned and not suspicious based on the provided artifacts. Before installing, make sure you are comfortable with cloud processing by mega-api-prod.nemovideo.ai, use a dedicated NEMO_TOKEN if possible, and avoid uploading sensitive videos or audio unless you trust the provider.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill can act against a NemoVideo session using the token, including creating sessions, checking credits, uploading media, and exporting renders.
The skill uses a service token or creates an anonymous token for the NemoVideo API. This is expected for the cloud rendering purpose, and the instructions say not to print tokens, but it is still account/session authority users should be aware of.
If `NEMO_TOKEN` environment variable is already set, use it ... Free token: Generate a UUID ... POST to `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token` ... `data.token` becomes your NEMO_TOKEN
Use a token intended for this service only, avoid sharing logs that might contain credentials, and monitor credit/session use if you provide your own NEMO_TOKEN.
Any clips, images, audio, URLs, and editing instructions you provide may leave your device and be processed by the remote provider.
User-selected videos or URLs are sent to the external NemoVideo cloud API for processing. This is central to the skill's purpose and the destination is disclosed, but uploaded media and prompts may contain private content.
**Upload**: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL: `{"urls":["<url>"],"source_type":"url"}`Only upload media you are comfortable sending to NemoVideo, and avoid including confidential, regulated, or highly personal content unless you trust the provider and its policies.
You have less independent information about who maintains the skill or the service relationship behind the API instructions.
The artifact has limited provenance information. There is no local code to scan, but the skill still instructs the agent to authenticate to and use a third-party cloud API.
Source: unknown; Homepage: none; No code files present — this is an instruction-only skill
Verify the publisher and service endpoint before using it with valuable tokens or sensitive media.
The remote editing service can cause the agent to continue workflow steps inside the video session, such as querying state or exporting, without showing every internal event.
The skill lets backend responses guide follow-up API calls such as state queries and export. This is expected for adapting a GUI-oriented backend to an agent workflow, but it means remote service responses influence tool use within the session.
The backend responds as if there's a visual interface. Map its instructions to API calls: ... "click" ... → execute the action via the relevant endpoint ... "Export" ... → run the export workflow
Use the skill for intended editing tasks and ask for status or confirmation before export if you want tighter control over each step.