ClawHub

Ai Video Editing

v1.0.10

AI Video Editor — Edit Videos by Chat with No Timeline, Add Music and Subtitles. Chat video editor — describe your edit and the AI executes it: trim, cut, me...

⭐ 1· 273·1 current·1 all-time
by@nemovideonemo
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
The skill name/description (AI video editing) matches the declared primary credential (NEMO_TOKEN), the documented API endpoints, and the config path (~/.config/nemovideo). No unrelated cloud credentials or binaries are requested.
!
Instruction Scope
SKILL.md instructs the agent to run curl calls to the nemo API, upload files with curl -F "files=@/path/to/file" (which reads arbitrary local paths), read/write ~/.config/nemovideo/client_id, and persist tokens. These behaviors are expected for video upload/edit workflows but also permit exfiltration of arbitrary local files if the agent is asked to upload non-media paths or if a malicious instruction is followed. The instructions do not strictly limit uploads to media mime types.
✓
Install Mechanism
Instruction-only skill with no install spec or downloaded code — lowest install risk. Nothing is written to disk by an installer beyond the behavior the SKILL.md itself prescribes (client_id persistence).
ℹ
Credentials
Only NEMO_TOKEN is the primary credential and other environment variables are optional (API URL, web URL, client id). The skill auto-generates/persists NEMO_CLIENT_ID and can request an anonymous token; this is proportional to a hosted editing backend. Be aware the bearer token (NEMO_TOKEN) grants access to the user's worker session and is valid for seven days per the docs, so protecting that token is important.
✓
Persistence & Privilege
always:false and no OS restrictions. The skill writes its own client_id to ~/.config/nemovideo (expected). It does not request system-wide changes or other skills' configs.
Assessment
This skill appears to be what it claims (a cloud-backed conversational video editor), but it performs network calls and allows uploading local files. Before installing or using it: - Only upload media you trust; do not use the skill to upload sensitive documents or arbitrary paths. - Treat NEMO_TOKEN as a bearer credential: prefer using an account/credential you can revoke; avoid putting long-lived secrets there. - Review nemovideo.com's privacy/terms to understand stored data retention and who can access uploaded files. - Be aware the skill will create ~/.config/nemovideo/client_id and request anonymous tokens (stored for ~7 days). If you stop using the skill, delete that directory and revoke tokens where possible. - If you need stronger guarantees, run uploads from a sandboxed environment or use an ephemeral account/token limited to non-sensitive files.

Like a lobster shell, security has layers — review code before you run it.

latestvk974wjyc2zj1v17h64tk1k5sd983kt1w

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
Primary envNEMO_TOKEN

Comments