Best Copywriter Video
v1.0.0Get persuasive copywriter videos ready to post, without touching a single slider. Upload your raw video footage (MP4, MOV, AVI, WebM, up to 500MB), say somet...
⭐ 0· 59·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match the runtime instructions: the SKILL.md describes uploading video, calling a cloud rendering API, editing voiceover/copy, and returning a processed MP4. Requesting a single API token (NEMO_TOKEN) is proportional to that purpose.
Instruction Scope
Instructions are focused on connecting to the nemo cloud API, managing sessions, uploading video, streaming SSE responses, and exporting results. They also instruct the agent to derive attribution headers from the YAML frontmatter and to detect the install path (e.g., ~/.clawhub/ or ~/.cursor/skills/) to set X-Skill-Platform. Detecting an install path implies reading well-known skill-installation paths; this is explainable for constructing headers but is broader filesystem access than a trivial API-only skill. The instructions also include a fallback anonymous-token flow (POST to /api/auth/anonymous-token) when NEMO_TOKEN is absent, which is reasonable but results in the agent calling an external endpoint and using returned tokens.
Install Mechanism
No install spec or code files are present; this is instruction-only, which is lowest risk. Nothing will be downloaded or written to disk by an installer step in the package metadata itself.
Credentials
Only one required environment variable (NEMO_TOKEN) is declared and used as the bearer token for the service — appropriate for a cloud API integration. The SKILL.md also references a config path (~/.config/nemovideo/) in its YAML frontmatter; registry metadata in the summary reported no required config paths, which is a minor inconsistency. The skill will also generate a UUID client id when needed and call the anonymous-token endpoint; no additional unrelated secrets are requested.
Persistence & Privilege
always:false and defaults for invocation are used. The skill does not request persistent platform-level privileges. It does rely on server-side sessions and tokens for render jobs (normal for cloud rendering).
Assessment
This skill appears to be what it says: a cloud video-editing/copywriting integration that requires an API token and uploads your video to nemo's rendering backend. Before installing or using it:
- Be aware that video/audio files are uploaded to https://mega-api-prod.nemovideo.ai — do not use sensitive or private footage unless you trust that service and its privacy policy.
- Provide a scoped or short‑lived NEMO_TOKEN if possible. If you omit NEMO_TOKEN the skill will obtain an anonymous token by calling the public anonymous-token endpoint (this is expected behavior but still results in network calls and data leaving your device).
- The SKILL.md instructs the agent to inspect install paths and a config directory (~/.config/nemovideo/). The package registry summary did not list required config paths, so ask the publisher to clarify whether the skill will read or write that config directory and what it contains.
- Confirm the endpoint domain (mega-api-prod.nemovideo.ai) is legitimate for your organization before giving any credentials.
- If you have compliance concerns, test with non-sensitive sample videos first and monitor network activity.
If you want higher assurance, request additional details from the publisher (privacy policy, endpoint ownership, what is stored server-side, retention of uploaded media, and whether the skill ever forwards data to other domains).Like a lobster shell, security has layers — review code before you run it.
latestvk97egkgqghwkvbjh550cma6ehh84qfjd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
✍️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
