Video Clip Maker With Music
v1.0.0create video clips or images into music-synced video clips with this skill. Works with MP4, MOV, AVI, WebM files up to 500MB. TikTok and Instagram creators u...
⭐ 0· 16·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (combine clips, add music, cloud rendering) align with the declared NEMO_TOKEN credential and the SKILL.md API endpoints at nemovideo.ai. No unrelated binaries or credentials are requested.
Instruction Scope
Runtime instructions focus on session creation, SSE messaging, uploads, and exports — appropriate for a cloud video service. Notes of caution: (1) the skill instructs using multipart uploads (files=@/path), which requires reading user-supplied files; (2) it auto-generates an anonymous token via an external endpoint if NEMO_TOKEN is absent and then treats that token as the session credential. Both behaviors are coherent with the purpose but have privacy implications (uploads + server-side processing).
Install Mechanism
No install spec and no code files — instruction-only. This is the lowest-risk install model.
Credentials
Only a single service token (NEMO_TOKEN) is required (declared as primaryEnv). That is proportionate to a cloud rendering API. Minor inconsistency: SKILL.md frontmatter references a config path (~/.config/nemovideo/) while the registry metadata reported none; this is likely informational but worth noticing.
Persistence & Privilege
always is false and the skill does not request system-wide changes or other skills' configs. It stores session_id for operations which is expected for a remote service workflow.
Scan Findings in Context
[no_findings] expected: The regex scanner found nothing — expected because the skill is instruction-only (no code files) so there was nothing for static analysis to inspect.
Assessment
This skill appears to do what it says, but consider the following before installing: (1) The service uploads your video/images to mega-api-prod.nemovideo.ai for server-side rendering — do not upload sensitive footage you don't want stored or processed off-site. (2) If you don't provide NEMO_TOKEN, the skill will call an anonymous-token endpoint and receive a short-lived token (100 free credits, 7-day expiry) which the agent will then use; review that behavior and whether you are comfortable with automatic token creation. (3) The skill may access local file paths you provide (multipart upload syntax), so confirm you only attach intended files. (4) Source/homepage is unknown — verify the service (nemovideo.ai) and its privacy/retention policies if you need stronger assurance. None of the findings indicate incoherence or unrelated credential requests, but the privacy/trust considerations above are the main operational risks.Like a lobster shell, security has layers — review code before you run it.
latestvk976hdxwq43ewkxjvc5q9m93d1851hv8
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎵 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN