ClawHub

Sponsored Video Maker

v1.0.1

Create professional sponsored content and brand partnership videos with AI — produce sponsor integration segments, dedicated brand videos, product placement...

⭐ 0· 52·0 current·0 all-time
by@siddylcon
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description (sponsored video creation) aligns with the runtime instructions: the SKILL.md shows a curl POST to a NemoVideo API to generate sponsor content. Requesting a single service token (NEMO_TOKEN) is consistent with calling a third-party API.
✓
Instruction Scope
Instructions (visible portion) direct the agent to send requests to the NemoVideo API and to provide a brand brief and creator style. There are no instructions to read unrelated files, harvest system data, or exfiltrate other credentials in the visible content. Note: SKILL.md is truncated in the registry dump, so full runtime instructions were not visible — that incomplete view reduces confidence.
✓
Install Mechanism
No install spec and no code files (instruction-only) — lowest installation risk since nothing is downloaded or written to disk by an installer.
ℹ
Credentials
The skill's declared primary credential NEMO_TOKEN is appropriate for an API-based video service. However, metadata inconsistencies exist: the SKILL.md metadata lists a config path (~/.config/nemovideo/) while the registry summary showed no required config paths; also primaryEnv is set while requires.env is empty. These mismatches should be clarified because a config path implies the skill may read local config files.
✓
Persistence & Privilege
always is false (normal). The skill does not request permanent/system-wide privileges and does not appear to modify other skills or global agent settings.
Assessment
This skill generally looks coherent for a service that generates sponsored-video deliverables: it uses a single API token (NEMO_TOKEN) and sends requests to a NemoVideo endpoint. Before installing: (1) confirm you trust the NemoVideo domain (mega-api-prod.nemovideo.ai) and the skill author — the registry shows an unknown source; (2) verify what NEMO_TOKEN actually grants (create a token with minimal scope or a test account if possible); (3) ask the publisher to clarify the metadata inconsistency about ~/.config/nemovideo/ (if the skill will read local config files, know what it will access); (4) inspect the full SKILL.md (the published file was truncated here) for any instructions that read other files or transmit other data; and (5) avoid supplying high-privilege or multi-service credentials — the token should be limited to the single service used by this skill. If any of these points are unclear or the endpoint/owner cannot be verified, treat the skill as untrusted.

Like a lobster shell, security has layers — review code before you run it.

latestvk9788fr19ysy0avp5yxc5k890h83rg03

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🤝 Clawdis
Primary envNEMO_TOKEN

Comments