Best Video Letter Maker
v1.0.0Skip the learning curve of professional editing software. Describe what you want — turn my written message and photos into a heartfelt video letter with back...
⭐ 0· 58·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill claims to create server-side video letters and its instructions call a remote nemo video API and request a service token (NEMO_TOKEN). Requesting a token for the video backend is proportionate and expected for this purpose.
Instruction Scope
SKILL.md instructs the agent to create/use an anonymous token if none is present, create a session, upload media, drive edits via SSE or API calls, poll export status, and return download URLs. These actions are within the stated scope and do not ask the agent to read unrelated system files or other credentials. The instructions explicitly warn not to print tokens or raw JSON.
Install Mechanism
This is an instruction-only skill with no install spec or code files. That minimizes on-disk execution risk; network calls are required to the documented nemo API domain (mega-api-prod.nemovideo.ai).
Credentials
The only declared credential is NEMO_TOKEN, which is appropriate. However, the SKILL.md frontmatter embeds a configPaths entry (~/.config/nemovideo/) while the registry metadata shows no required config paths — this mismatch should be clarified. Access to a user config directory could be reasonable (to read/store tokens), but it is not justified or described clearly in the instructions.
Persistence & Privilege
The skill is not always-enabled and does not request elevated or persistent platform privileges. It instructs creating a session and saving session_id (normal for remote-service clients). Autonomous invocation is allowed by default but is expected for skills of this type.
Assessment
This skill appears to be what it claims: a client for a remote video-rendering service that needs a single service token (NEMO_TOKEN). Before installing or using it, consider: 1) Only provide a token you intend to give the nemovideo service — treat NEMO_TOKEN like an account credential. 2) If you don't want to expose your primary account, use the anonymous-token flow described in the SKILL.md to obtain a temporary token. 3) Ask the skill author (or inspect runtime behavior) to clarify the frontmatter configPaths (~/.config/nemovideo/) vs. registry metadata mismatch — confirm whether the agent will read or write files in your home config directory. 4) Review the service's privacy/retention policy before uploading personal photos/audio. 5) If you want extra caution, run the skill with a temporary or scoped token and avoid uploading sensitive media until you confirm behavior.Like a lobster shell, security has layers — review code before you run it.
latestvk975g5md5c1ds89a4w9xpyps2d84nk69
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
💌 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN