Ai Video Summarizer
v1.0.0Summarize any video using AI — extract key points, generate chapter breakdowns, create highlight clips, produce text summaries, and identify the most importa...
⭐ 0· 102·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill's name/description match the behavior in SKILL.md: it calls a NemoVideo API to summarize videos and produce clips. Requesting a provider token (NEMO_TOKEN) is proportionate. However there is a minor metadata inconsistency: the registry summary showed no required config paths/env vars, while the SKILL.md metadata lists configPaths: ~/.config/nemovideo/ and primaryEnv: NEMO_TOKEN. This mismatch should be clarified (token is expected, but the registry fields are inconsistent).
Instruction Scope
The SKILL.md instructions are narrowly scoped to uploading a video or passing a URL and calling the remote API (example curl uses Authorization: Bearer $NEMO_TOKEN). The instructions do not tell the agent to read arbitrary system files, other environment variables, or to transmit unrelated local data. The primary runtime action is a network call to the NemoVideo API and uploading video content — which is expected for this service.
Install Mechanism
No install spec and no code files are present (instruction-only). That is lowest-risk from an install perspective — nothing is written to disk or executed locally by the skill itself.
Credentials
The only credential referenced is NEMO_TOKEN (declared as primaryEnv in SKILL.md), which is appropriate for an external service. However the registry metadata earlier listed no required env vars while SKILL.md lists primaryEnv: NEMO_TOKEN and configPaths: ~/.config/nemovideo/. This inconsistency should be resolved. Also be aware that providing the NEMO_TOKEN grants the skill ability to call the third-party API on your behalf and potentially access uploaded video data.
Persistence & Privilege
always is false (not force-included) and disable-model-invocation is false (normal). The skill does not request persistent system privileges or to modify other skills. Autonomous invocation is allowed by default — this is expected behavior for skills and not a standalone concern here.
Scan Findings in Context
[no-findings] expected: The regex-based scanner found nothing to analyze; this is expected because the skill is instruction-only (SKILL.md) with no code files. The lack of findings is not evidence of safety — review the instructions and network endpoints manually.
Assessment
This skill appears to be what it says: an instruction-only connector to the NemoVideo summarization API that requires a Nemo service token. Before installing or enabling it, confirm the following: 1) The NEMO_TOKEN you will provide is for a trusted NemoVideo account/service; avoid using high‑privilege or shared tokens. 2) Understand privacy: any video you upload (meeting recordings, confidential content) will be sent to mega-api-prod.nemovideo.ai — check NemoVideo's data retention and sharing policies before sending sensitive material. 3) Clarify the metadata mismatch (registry vs SKILL.md) about configPaths and env var declarations. 4) Test with non-sensitive sample videos first and consider creating a dedicated token you can revoke. If you need stronger assurance, ask the publisher for their privacy/security documentation and for confirmation of the exact endpoints and scopes the token grants.Like a lobster shell, security has layers — review code before you run it.
latestvk97b5wq09s0myv2wzppgfxck1h83srtd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📋 Clawdis
Primary envNEMO_TOKEN