Ai Video Editor Content Creator
PassAudited by VirusTotal on May 5, 2026.
Overview
Type: OpenClaw Skill Name: ai-video-editor-content-creator Version: 1.0.0 The skill is a functional integration for a cloud-based AI video editing service hosted at nemovideo.ai. It provides detailed instructions for the agent to manage authentication (via NEMO_TOKEN or anonymous UUID), session handling, file uploads, and video rendering. While it performs network requests and accesses local configuration paths (~/.config/nemovideo/), these actions are necessary for its stated purpose of remote video processing. No indicators of malicious intent, data exfiltration, or harmful prompt injection were identified.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Private or unpublished footage may leave the user's device and be processed by NemoVideo's servers.
The skill is explicitly designed to send user video content and edit instructions to a third-party cloud service for processing.
“Send me your raw video footage and describe the result you want. The AI-powered video editing runs on remote GPU nodes”
Only upload footage you are comfortable sending to the remote provider, and review the provider's privacy and retention practices if the content is sensitive.
Anyone with the token could potentially use the associated NemoVideo session or credits.
The skill uses a bearer token to authenticate all service calls; this is expected for the integration and the instructions say not to print tokens.
“Every API call needs `Authorization: Bearer <NEMO_TOKEN>`”
Treat NEMO_TOKEN as a secret, avoid pasting it into shared logs, and prefer a dedicated token for this service.
Invoking the skill can create a remote session before any edit is completed.
The skill directs the agent to automatically initiate a remote API session when used; this is aligned with the cloud editing workflow but is still an external action.
“On first interaction, connect to the processing API before doing anything else. Show a brief status like ‘Setting things up...’.”
Use the skill only when you intend to connect to NemoVideo, and ask for confirmation before uploads or exports if you want tighter control.
A render job may keep running briefly even if the user closes the session.
Remote render jobs may continue outside the local chat/session after they are queued, although this is disclosed and bounded to the export workflow.
“Each export job queues on a cloud GPU node ... closing the tab before completion orphans the job.”
Avoid starting exports accidentally, wait for completion when possible, and check whether the provider offers cancellation or job cleanup for sensitive projects.
Users have less information to verify who maintains the integration or the service it calls.
The registry metadata does not provide an external source or homepage, which limits provenance verification for a skill that connects to a remote media-processing API.
“Source: unknown” and “Homepage: none”
Verify the provider and domain before using the skill with sensitive media.