Social Impact Video
v1.1.0Social Impact Video Maker — Create Advocacy and Change-Making Videos.
⭐ 0· 71·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (social impact video creation) align with the runtime instructions which call a remote API to generate videos, request impact data and community footage, and return MP4 outputs. Requesting a service token (NEMO_TOKEN) and a config path for nemovideo is reasonable for this purpose.
Instruction Scope
SKILL.md instructs the agent to POST generation requests and poll job status against https://mega-api-prod.nemovideo.ai using an Authorization: Bearer $NEMO_TOKEN header — scope is limited to the external API. The instructions mention collecting beneficiary footage and impact data; this raises privacy/consent considerations (the skill itself does not show instructions to read unrelated local files or exfiltrate other credentials).
Install Mechanism
Instruction-only skill with no install spec or code files; nothing is written to disk by the skill itself. This is the lowest-risk install profile.
Credentials
The only declared primary credential is NEMO_TOKEN, which is appropriate for a hosted video API. Minor metadata inconsistency: requires.env is empty but primaryEnv is set to NEMO_TOKEN — this should be clarified. No other unrelated secrets are requested.
Persistence & Privilege
always is false and the skill is user-invokable; it does not request permanent presence or system-wide config changes. Autonomous invocation is allowed (default) but not combined with other high-risk indicators.
Assessment
This skill appears coherent for a hosted video-generation service, but take these practical precautions before installing: 1) Verify the service/domain (mega-api-prod.nemovideo.ai) and the skill publisher since no homepage or source is provided. 2) Only provide a least-privilege NEMO_TOKEN (short-lived or scoped) and rotate it if you stop using the skill. 3) Do not upload sensitive personally identifiable data or beneficiary footage without explicit informed consent and a reviewed privacy/retention policy for the service. 4) Inspect or confirm what is stored under ~/.config/nemovideo/ if the agent will write config there. 5) Test with dummy data first to confirm behavior and output URLs, and confirm outputs are served from the expected domain. 6) Ask the publisher to resolve the small metadata mismatch (primaryEnv present but requires.env empty) so you know how the agent will handle the token.Like a lobster shell, security has layers — review code before you run it.
latestvk975188cc5c28m9js79pb3qjb983sb41
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
✊ Clawdis
Primary envNEMO_TOKEN