ClawHub

Invitation Video Maker

v1.0.0

Cloud-based invitation-video-maker tool that handles creating event invitation videos for weddings, birthdays, and parties. Upload JPG, PNG, MP4, MOV files (...

⭐ 0· 16·0 current·0 all-time
bypeandrover adam@peand-rover
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
The name/description (cloud invitation-video creation) matches the runtime actions: session creation, file upload, SSE-based edit messages, render/export endpoints and a single required credential (NEMO_TOKEN). Requiring a service token for a remote render API is proportionate to the stated purpose.
ℹ
Instruction Scope
SKILL.md confines actions to creating a session, uploading user-provided media, sending SSE messages, and polling render endpoints. It does instruct the agent to check environment for NEMO_TOKEN and, if absent, to POST to an anonymous-token endpoint to obtain one. The frontmatter also references a config path (~/.config/nemovideo/) and detection of install path (~/.clawhub/, ~/.cursor/skills/) which implies the agent may inspect local paths; this is reasonable for attribution but is broader than strictly necessary for a stateless uploader and should be noted.
✓
Install Mechanism
No install spec, no code files — instruction-only. This minimizes filesystem persistence and executable installs; runtime network calls are the primary risk surface.
ℹ
Credentials
Only a single credential (NEMO_TOKEN) is declared and used, which is appropriate for a remote-rendering API. However, SKILL.md's frontmatter lists a config path (~/.config/nemovideo/) (despite the registry metadata earlier saying none), so the agent may read or look for local token/config files. The skill also implements an automated anonymous-token acquisition flow (server POST) when no token is present — convenient but means the skill will perform network auth automatically.
✓
Persistence & Privilege
always is false and there is no instruction to modify other skills or global agent settings. The skill will create ephemeral sessions and render jobs; it notes orphaned jobs if the client closes the tab, but it does not request persistent 'always' presence or elevated privileges.
Assessment
This skill will upload files you provide to a remote service (mega-api-prod.nemovideo.ai) and needs a NEMO_TOKEN to authenticate. If you do not provide a token, the skill will automatically request an anonymous token from the service and use it for up to 7 days per the docs. Before installing: confirm you trust the service and are comfortable with your media being uploaded to that domain; check whether tokens are stored on disk (frontmatter mentions ~/.config/nemovideo/); avoid providing other unrelated secrets; and prefer obtaining an explicit API token from the service if you want control over lifecycle and deletion. The skill is instruction-only (no code installs), which reduces installer risk, but network behavior and metadata inconsistencies (declared vs frontmatter config paths) warrant a cautious install. If you need higher assurance, ask the publisher for a homepage, privacy policy, or source code, or request explicit details about where/how tokens are persisted.

Like a lobster shell, security has layers — review code before you run it.

latestvk976aedhhtd4aj8hagrv036hyn84h7cd

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

💌 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments