ClawHub

Free Subtitle Maker

v1.0.0

Drop a video and describe your subtitle style — this free-subtitle-maker skill transcribes your audio, formats the captions, and burns them directly into you...

⭐ 0· 42·0 current·0 all-time
by@tk8544-b
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
The skill claims to run subtitles via the NemoVideo backend and only requests a single credential (NEMO_TOKEN) plus a per-user client_id config path; these align with a remote transcription/encoding service. No unrelated credentials, binaries, or installs are requested.
ℹ
Instruction Scope
SKILL.md instructs the agent to create/read ~/.config/nemovideo/client_id, obtain or use a NEMO_TOKEN, create sessions, upload videos, and stream SSE messages to the NemoVideo API—all consistent with the described purpose. It also asks the agent to read the SKILL.md frontmatter and detect the agent install path to set X-Skill-Platform; reading those paths is unnecessary for core functionality but low-risk. Important privacy note: the workflow builds a claim URL that includes the token in the query string (token=$TOKEN), which can expose auth tokens if the URL is shared or logged.
✓
Install Mechanism
Instruction-only skill with no install steps and no code files. This minimizes on-disk changes and is proportionate to the described functionality.
ℹ
Credentials
Only NEMO_TOKEN is declared as required and is justified by the remote API calls. The skill will also create/read ~/.config/nemovideo/client_id for anonymous tokens. Those items are proportional, but embedding tokens in a claim URL (and storing client_id locally) creates token-handling/privacy considerations that users should accept knowingly.
✓
Persistence & Privilege
always:false (no forced global inclusion). The skill stores per-user client_id in its own config path (~/.config/nemovideo/) and does not request system-wide settings or other skills' credentials.
Scan Findings in Context
[no_regex_findings] expected: Scanner found no regex matches; this is expected because the skill is instruction-only (SKILL.md) and has no code files for static analysis.
Assessment
This skill uploads your video/audio to the NemoVideo service and requires an API token (NEMO_TOKEN) or will generate a short-lived anonymous token. Before installing: 1) Confirm you trust https://nemovideo.com and review its privacy/terms because uploaded media and transcripts will leave your device. 2) Prefer using an anonymous token when possible (short-lived) for sensitive content. 3) Be aware the skill builds a claim URL that places the token in the query string — avoid sharing that link and treat it like a secret. 4) Check that storing ~/.config/nemovideo/client_id on your machine is acceptable. If any of these are unacceptable, do not install or use the skill.

Like a lobster shell, security has layers — review code before you run it.

latestvk975m69e16wm2vs5p3czq41s7583yddv

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments