ClawHub

Video Generator Fast

v1.0.0

Cloud-based video-generator-fast tool that handles generating short videos quickly from text prompts or images. Upload MP4, MOV, JPG, PNG files (up to 200MB)...

⭐ 0· 15·0 current·0 all-time
by@imo14reifey
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
The skill is a cloud video generator and only requests a single service token (NEMO_TOKEN) and uses API endpoints under mega-api-prod.nemovideo.ai — this is consistent with the stated purpose. Small inconsistency: the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) while the registry metadata earlier reported no required config paths.
ℹ
Instruction Scope
Runtime instructions are focused on authenticating, creating a session, uploading media, and polling job status — all expected for a cloud render pipeline. The skill instructs obtaining an anonymous token automatically (POST to the external API) and to detect the agent's install path (checking ~/.clawhub/ and ~/.cursor/skills/) to set X-Skill-Platform headers. These are within scope for attribution but do require reading some local paths and storing a session_id/token in-memory or on-disk (storage location not specified). The SKILL.md also instructs hiding raw API responses and token values from the user.
✓
Install Mechanism
There is no install spec and no code files — instruction-only skills are lowest install risk because nothing is written to disk by an installer. All network activity is described in the instructions rather than an installer fetching code.
✓
Credentials
Only one declared environment variable (NEMO_TOKEN / primary credential) is required, which is proportional for an API-backed service. The skill offers to obtain an anonymous token if none is present, so it does not require pre-provisioned secrets. No unrelated credentials are requested.
✓
Persistence & Privilege
The skill does not request always:true or other elevated privileges. It will create and use a session token for backend calls, but there is no instruction to modify other skills or system-wide settings. Where session/token data is stored is unspecified — a benign but noteworthy omission.
Assessment
What to consider before installing: - The skill will contact https://mega-api-prod.nemovideo.ai and may create an anonymous token for you (NEMO_TOKEN) to run rendering jobs; only install if you trust that service. - The skill may read certain home paths (~/.clawhub/, ~/.cursor/skills/, possibly ~/.config/nemovideo/) to determine platform or store session info. If you prefer not to let skills access your home directory, do not install. - The SKILL.md tells the agent to hide raw API responses and token values from the user — that is normal for token handling, but it means you won’t see the token if the skill auto-creates one. - There is no publisher/homepage listed and source is unknown; lack of provenance increases risk. Ask the publisher where session tokens and uploads are stored, what their privacy/retention policy is, and whether uploads are forwarded to third parties. - Avoid uploading sensitive or regulated data (PII, proprietary assets) until you verify the vendor’s privacy and security practices. If you want to proceed: prefer supplying your own NEMO_TOKEN (if the vendor provides one) rather than letting the skill generate and hold an anonymous token, and request clarification about where session state and any downloaded media are persisted.

Like a lobster shell, security has layers — review code before you run it.

latestvk97dd1hrp2bbs5ygyexs0w1fzs84gp3h

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

⚡ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments