Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Reduce Video Size - Compress and Shrink Video Files with AI
v1.0.0Video compressor that reduces video file size through AI chat. Upload a video and specify your target: "compress to under 25MB for email" or "reduce file siz...
⭐ 0· 44·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to compress/convert videos via an AI backend and all runtime instructions call a NemoVideo API (upload, render, SSE messaging). Requesting a Nemo token and uploading video files is coherent with that purpose.
Instruction Scope
SKILL.md instructs the agent to perform network calls (curl), upload user files (curl -F files=@/path/to/file), use SSE endpoints, and poll render jobs. It also instructs the agent to read and write ~/.config/nemovideo/client_id and to persist a token as NEMO_TOKEN. These operations are expected for a remote video-processing skill but grant the skill the ability to read/stream local files and write to a user config directory — verify you’re comfortable with file uploads and config persistence.
Install Mechanism
Instruction-only skill with no install spec or code files; nothing is downloaded or extracted. This minimizes disk footprint beyond the explicit config writes described in SKILL.md.
Credentials
Registry shows no required env vars but declares a primary credential NEMO_TOKEN; SKILL.md references multiple environment variables (NEMO_TOKEN, NEMO_API_URL, NEMO_WEB_URL, NEMO_CLIENT_ID, SKILL_SOURCE) and a config path (~/.config/nemovideo/) that were not consistently declared. The skill will auto-generate/persist client_id and request an anonymous token, storing it as NEMO_TOKEN. Access to these env vars and the config path is reasonably related to the service, but the mismatch between declared requirements and actual instructions is an inconsistency you should ask the author to clarify.
Persistence & Privilege
The skill does not request elevated or always-on privileges. It will persist a client_id to ~/.config/nemovideo/client_id and instruct saving an authentication token (NEMO_TOKEN). Persisting tokens and client IDs in the user's home config is typical for a cloud client but is persistent and gives the skill ongoing access until the token expires or is removed.
What to consider before installing
This skill forwards uploaded video files to a remote NemoVideo API and will create/write ~/.config/nemovideo/client_id and store an auth token (NEMO_TOKEN). Before installing or using: 1) Confirm you trust the NemoVideo backend and the API domain (the SKILL.md defaults to https://mega-api-prod.nemovideo.ai and https://nemovideo.com). 2) Be aware any videos you upload will be sent off-device — do not upload sensitive private footage unless you accept that. 3) The skill references environment variables and a config path that are not consistently declared in the registry; ask the publisher to clarify which env vars are required and how tokens are stored. 4) If you prefer, create a limited/anonymous account or provide a token with constrained lifetime/permissions rather than letting the skill auto-generate and persist credentials. 5) If you’re uncomfortable with automatic config writes or token persistence, do not install/use the skill.Like a lobster shell, security has layers — review code before you run it.
latestvk97b5vmqt0x03fg551sc6kmazh83h9nc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
Primary envNEMO_TOKEN