ClawHub

Youtube With Ai

v1.0.0

edit video clips into YouTube-ready videos with this skill. Works with MP4, MOV, AVI, WebM files up to 500MB. YouTubers use it for editing and optimizing vid...

⭐ 0· 58·0 current·0 all-time
by@mory128
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description (YouTube video editing) align with the declared main credential (NEMO_TOKEN) and the API endpoints in SKILL.md. Requesting a service token and workflows for upload, render, and download are proportionate to video-processing functionality.
ℹ
Instruction Scope
Instructions are mostly scoped to creating sessions, uploading files, streaming SSE, polling render status, and returning download URLs — all expected. Minor scope notes: the skill instructs the agent to read its YAML frontmatter at runtime and to detect the install path to populate attribution headers; that requires the agent to inspect its own skill files or filesystem locations (harmless but wider than a pure stateless API caller). The SKILL.md also instructs generating anonymous tokens when no NEMO_TOKEN exists, which is coherent but implies the agent will obtain and store short-lived tokens.
✓
Install Mechanism
No install spec and no code files exist (instruction-only), so nothing will be downloaded or written by an installer. This is the lowest-risk install profile.
✓
Credentials
Only one environment variable is declared (NEMO_TOKEN) and is appropriate for an external video-processing API. The SKILL.md also provides a documented anonymous-token flow when NEMO_TOKEN is absent — expected for anonymous usage. There are no unrelated credentials requested.
✓
Persistence & Privilege
The skill does not request always:true and does not modify other skills. It does instruct storing session_id/tokens for interacting with the backend (normal for this use case). There is a runtime persistence of session state on the backend (orphaned jobs are possible if the client disconnects) but no excessive privileges are requested.
Scan Findings in Context
[no-code-to-scan] expected: The static scanner found nothing because this is an instruction-only skill (SKILL.md). That is expected; the runtime instructions are the primary surface for review.
Assessment
This skill will upload your video files and metadata to an external service (mega-api-prod.nemovideo.ai) for processing — consider privacy and TOS implications before uploading sensitive content. The skill needs a NEMO_TOKEN (your service credential) or it will create an anonymous token for limited usage; treat either token as access to your account (don't share it). Note a minor inconsistency: the SKILL.md metadata references a config path (~/.config/nemovideo/) and runtime behavior to read its frontmatter/install path for attribution, so the agent may inspect its skill files or certain user config locations — harmless for normal use but worth knowing. If you need higher assurance, verify the nemo service's legitimacy, test with non-sensitive videos, and avoid providing private credentials unless you trust the provider.

Like a lobster shell, security has layers — review code before you run it.

latestvk974mfzxty11k9qerrvzkg9krx84nfvg

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

▶️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments