ClawHub

Editor Japonais

v1.0.0

Cloud-based editor-japonais tool that handles editing videos with Japanese visual aesthetics and style. Upload MP4, MOV, AVI, WebM files (up to 500MB), descr...

⭐ 0· 22·0 current·0 all-time
by@udnerc
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
The skill's name and description (cloud video editor with Japanese-style edits) align with its declared single credential (NEMO_TOKEN) and the runtime instructions to upload video, create sessions, and request renders from the nemovideo API. No unrelated credentials or binaries are requested.
ℹ
Instruction Scope
Runtime instructions are scoped to creating a session, uploading media, streaming SSE edits, polling render status, and retrieving results — all coherent for a cloud editor. However the instructions ask the agent to derive an X-Skill-Platform header by inspecting install paths (e.g., checking ~/.clawhub/ and ~/.cursor/), which would require reading the filesystem; this is not strictly necessary for core functionality and is a minor scope creep.
✓
Install Mechanism
No install spec or code files are present (instruction-only), so nothing is written to disk by an installer. This is the lowest-risk install model.
ℹ
Credentials
Only one environment variable is required (NEMO_TOKEN), which matches the skill's use of a bearer token for the API. That is proportionate. The SKILL.md frontmatter also lists a config path (~/.config/nemovideo/) even though the registry metadata showed no required config paths — this mismatch suggests the skill may expect or look for local config files, which should be justified or removed.
✓
Persistence & Privilege
The skill is not marked always:true and is user-invocable; it requests no elevated or persistent platform privileges. Saving a session_id locally is normal for session management and not problematic by itself.
Assessment
This skill appears to do what it claims: it uploads your video files to an external nemovideo API, performs edits, and returns a download URL. Before installing or invoking it: (1) Understand that your media will be uploaded to https://mega-api-prod.nemovideo.ai — only proceed if you trust that service with the content and metadata you send. (2) Prefer the anonymous-token flow (the skill can request a short-lived anonymous token) instead of placing long-lived or high-privilege secrets in NEMO_TOKEN. (3) Be aware the instructions ask the agent to detect install paths / a local config path; if you do not want the agent to inspect your home directories, ask the maintainers to remove that step or confirm what is read. (4) The skill's source and homepage are unknown; if you need stronger assurance, request provenance (who runs the endpoint, privacy/retention policy) before sending sensitive footage. Overall: functionally coherent, but exercise the usual caution when uploading media and when providing tokens.

Like a lobster shell, security has layers — review code before you run it.

latestvk970mswdgxfrecj80byv6my0n984kndc

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎌 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments