Nemovideo
v2.0.0Content creators who need to produce polished videos without a full editing suite will find nemovideo a practical daily tool. It handles video generation, sc...
⭐ 0· 124·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (video generation/editing) matches the declared primary credential (NEMO_TOKEN) and the SKILL.md's cloud API endpoints for rendering, upload, sessions and credits. The actions the skill describes (uploading media, submitting render jobs, polling for outputs) are coherent with the stated purpose. Note: the SKILL.md frontmatter lists a configPaths entry (~/.config/nemovideo/) even though the registry metadata above reported no required config paths — this is an inconsistency to be aware of.
Instruction Scope
Runtime instructions are specific: check NEMO_TOKEN, create an anonymous token if missing (POST to mega-api-prod.nemovideo.ai), create sessions, send SSE messages, upload local files via multipart, and poll render endpoints. Reading local files for upload and reading an install path to set X-Skill-Platform are expected for this skill, but they mean the agent will access local file paths and make network calls that transmit user media and metadata to a third-party backend. SKILL.md explicitly says not to expose tokens/raw API output, which is good guidance but relies on agent behavior.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest install risk. No binaries or external installers are requested.
Credentials
Only NEMO_TOKEN is required (declared primary credential), which is proportionate for a cloud API. However, the skill will (if NEMO_TOKEN absent) obtain an anonymous token from the provider automatically; that token is used to authorize uploads and renders. Also note the SKILL.md frontmatter lists a configPaths entry (~/.config/nemovideo/) that was not present in the earlier registry summary — inconsistent metadata.
Persistence & Privilege
always is false (no forced permanent inclusion). The skill can be invoked autonomously by the agent (platform default). The SKILL.md expects the agent to keep session_id in-session for operations, but it does not request system-wide privileges or modifications to other skills.
Assessment
This skill appears to do what it says: upload your media to a third-party GPU backend, create sessions, and return rendered outputs. Before installing or using it: 1) Be aware that media files you upload will be sent to https://mega-api-prod.nemovideo.ai — do not upload sensitive or private footage unless you trust the provider and have verified their privacy/terms. 2) The skill will create or use a NEMO_TOKEN (it can auto-request an anonymous token); treat that token as a secret. 3) There is a small metadata mismatch: SKILL.md lists a config path (~/.config/nemovideo/) while the registry metadata earlier did not — consider this benign but confirm where credentials/sessions would be stored. 4) No install files are included, so risk is limited to runtime network/file access; still review the endpoint/domain and the publisher before providing sensitive data. If you need higher assurance, ask the publisher for a homepage, documentation, or a signed package/source repository to verify provenance.Like a lobster shell, security has layers — review code before you run it.
latestvk972200rg755any2vjvs9gm6mx84d1jw
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN