ClawHub

Video Converter

v1.0.0

content creators, students, everyday users convert video files into converted MP4 files using this skill. Accepts AVI, MOV, MKV, WebM up to 500MB, renders on...

⭐ 0· 23·0 current·0 all-time
bypeandrover adam@peand-rover
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
ℹ
Purpose & Capability
The skill's name/description match the behavior in SKILL.md: it sends user videos to a cloud render backend and returns MP4s. Requested credential (NEMO_TOKEN) is appropriate for that backend. However, the SKILL.md frontmatter includes a config path (~/.config/nemovideo/) while the registry metadata lists no required config paths — this mismatch should be clarified.
ℹ
Instruction Scope
Runtime instructions are focused on creating sessions, uploading files, streaming SSE events, and starting renders on mega-api-prod.nemovideo.ai — all coherent with video conversion. The skill will upload user-provided files to an external service (expected for conversion) and will request/generate an anonymous token if NEMO_TOKEN is absent. This is a privacy-relevant behavior (user files and metadata leave the local environment). Instructions do not appear to read unrelated system secrets, but they do instruct detecting the agent install path to set an attribution header.
✓
Install Mechanism
No install spec or code files are included (instruction-only), so nothing is written to disk by an installer. This is the lowest install risk.
ℹ
Credentials
Only one credential is declared (NEMO_TOKEN), which is proportional to the described backend usage. The skill also describes a fallback anonymous-token flow (POST to the service to obtain a token) — that is plausible but means the skill will call an external auth endpoint and receive a token it will use for requests. The frontmatter's configPaths declaration conflicts with registry metadata (registry claimed none) — worth clarifying because config paths can imply broader file access.
✓
Persistence & Privilege
The skill is not always-enabled and uses normal autonomous invocation. It does store and reuse session_id/tokens for its own operations (normal for a service client) and does not request elevated system-wide privileges or attempt to modify other skills.
Assessment
This skill will upload any video files you give it to mega-api-prod.nemovideo.ai and will use or obtain a NEMO_TOKEN to do so. Before installing or using it: (1) Decide whether you are comfortable sending those videos to an external cloud service (do not upload sensitive/personal content unless you trust the service). (2) Prefer to provide your own NEMO_TOKEN from a trusted account rather than relying on anonymous-token creation, and verify token storage/expiry policies. (3) Ask the publisher to clarify the metadata mismatch about config paths (~/.config/nemovideo/) and confirm what, if anything, is stored locally. (4) Verify the domain (mega-api-prod.nemovideo.ai) and check for an official project/homepage or privacy/terms before use. If you are uncertain, test with a non-sensitive sample clip first and revoke/regenerate any tokens after testing.

Like a lobster shell, security has layers — review code before you run it.

latestvk9777wehyz0z2d40q05k89mh1984kjw7

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🔄 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments