Video Lyrics
v1.0.0Turn a 3-minute music video in MP4 format into 1080p lyrics-overlaid videos just by typing what you need. Whether it's adding synced lyrics text to music vid...
⭐ 0· 58·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description match the runtime instructions: the skill uploads videos, creates a session, streams edit commands, and requests renders from a remote nemovideo.ai backend. The single declared credential (NEMO_TOKEN) is appropriate for an external API. Minor inconsistency: the registry metadata provided with the skill listed no required config paths, but the SKILL.md frontmatter declares a config path (~/.config/nemovideo/).
Instruction Scope
Instructions are narrowly focused on creating/using a session, uploading media, reading SSE responses, and polling render status. The skill will (a) look for NEMO_TOKEN and if absent obtain an anonymous token by POSTing to the service, and (b) upload user media to the listed mega-api-prod.nemovideo.ai endpoints. It also describes detecting an install path to set an X-Skill-Platform header (this implies filesystem/environment probing for platform fingerprinting). There are no instructions to read unrelated local files or other environment variables.
Install Mechanism
This is instruction-only with no install spec and no bundled code — nothing is downloaded or written by an installer. That reduces supply-chain risk; the only runtime network operations are HTTP calls to the described backend.
Credentials
The only required environment variable is NEMO_TOKEN (declared primary credential), which is proportional to calling a third-party API. The skill will also generate/obtain an anonymous token if none is present. The SKILL.md metadata references a config path (~/.config/nemovideo/) and uses install-path detection for an X-Skill-Platform header; these are plausible for attribution but could be used to fingerprint the host. No unrelated secrets or broad system credentials are requested.
Persistence & Privilege
The skill does not request always:true and does not declare writing/modifying other skills or system-wide config. It keeps session IDs and tokens for the operation lifecycle (normal for a session-based cloud API). Autonomous invocation is allowed but is the platform default and not itself a red flag here.
Assessment
This skill will upload your video and audio files to an external service (mega-api-prod.nemovideo.ai) and will use or create an API token (NEMO_TOKEN). Before installing: (1) confirm you trust the service and its privacy/retention policy (you may be uploading copyrighted or private content), (2) avoid putting high-privilege credentials in NEMO_TOKEN — use a limited or disposable token if possible, (3) be aware the skill may probe install paths to set an attribution header (minor fingerprinting risk), and (4) verify the service/domain ownership if you need stricter assurance. If you want stronger guarantees, ask the publisher for a privacy/security policy and details on how long uploads and anonymous tokens persist.Like a lobster shell, security has layers — review code before you run it.
latestvk975g410s88t9dwn48xn5173n984n5ag
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎵 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN