Srt Generator Ai

PassAudited by VirusTotal on May 6, 2026.

Overview

Type: OpenClaw Skill Name: srt-generator-ai Version: 1.0.0 The skill is a functional wrapper for a cloud-based video processing service (nemovideo.ai). It provides instructions for an AI agent to manage authentication via tokens, upload media files, and poll for SRT/video generation results. All network activity and data handling (including the use of NEMO_TOKEN and config paths) are strictly aligned with the stated purpose of subtitle generation. No evidence of malicious intent, unauthorized data exfiltration, or harmful prompt injection was found in SKILL.md or _meta.json.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A user expecting only a subtitle file may instead trigger broader cloud video-rendering workflows or receive a rendered video output.

Why it was flagged

The visible instructions alternate between SRT subtitle generation and rendered MP4 export, so the capability is broader and less precise than the title alone suggests.

Skill content
"generate an SRT subtitle file from my video in English" ... "hands you a 1080p MP4"
Recommendation

Confirm whether you want an SRT file, a rendered MP4, or both before uploading media or exporting.

What this means

The agent may create sessions, poll jobs, upload files, or start exports through the provider API as part of normal use.

Why it was flagged

The skill instructs the agent to perform remote API setup and endpoint workflows automatically within the media-processing task.

Skill content
"On first interaction, connect to the processing API before doing anything else"; "Export" or "导出" → run the export workflow
Recommendation

Use it only when you intend cloud processing, and explicitly confirm uploads/exports if the media or credits matter.

What this means

There is limited provenance information for deciding whether to trust the provider with uploaded media.

Why it was flagged

The artifacts do not provide a source repository or homepage to independently verify the skill publisher or service documentation.

Skill content
Source: unknown; Homepage: none
Recommendation

Verify the NemoVideo service/domain and publisher through a trusted channel before sending sensitive recordings.

What this means

Anyone with the token could potentially use the associated NemoVideo API access or credits.

Why it was flagged

The skill uses a service token for authenticated API calls and references a NemoVideo config path; this is expected for the cloud service but is still account/credit-bearing authority.

Skill content
"requires": {"env": ["NEMO_TOKEN"], "configPaths": ["~/.config/nemovideo/"]} ... "Authorization: Bearer <NEMO_TOKEN>"
Recommendation

Keep NEMO_TOKEN private, avoid pasting it into chats, and rotate/revoke it if exposed.

What this means

Private interviews, voices, faces, or other media content may leave the local environment for cloud processing.

Why it was flagged

The intended workflow sends user video/audio files and session data to an external provider API; the artifacts disclose this, but do not detail retention or privacy controls.

Skill content
"runs AI subtitle generation through a cloud rendering pipeline"; "Upload — POST /api/upload-video/nemo_agent/me/<sid>"
Recommendation

Only upload files you are comfortable sharing with the provider, and check the provider’s privacy/retention terms for sensitive content.