ClawHub

Sora Ai Video Creator

v1.0.0

Cloud-based sora-ai-video-creator tool that handles generating videos from text descriptions. Upload MP4, MOV, WebM, GIF files (up to 500MB), describe what y...

⭐ 0· 57·0 current·0 all-time
by@tk8544-b
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name and description match the requested env var (NEMO_TOKEN), the declared config path (~/.config/nemovideo/) and the documented API endpoints. Required artifacts (token, session_id, upload endpoints, SSE) are appropriate for a remote video-rendering service.
ℹ
Instruction Scope
SKILL.md instructs the agent to auto-request an anonymous token, create and store a session_id, stream SSE, and upload user media to https://mega-api-prod.nemovideo.ai. These actions are expected for the stated purpose, but they involve sending potentially large user files and metadata to an external service and storing session tokens locally. There are no instructions to read unrelated system files or other credentials.
✓
Install Mechanism
Instruction-only skill with no install spec or code files. This minimizes on-disk risk; nothing is downloaded or executed by the skill itself.
✓
Credentials
Only a single credential (NEMO_TOKEN) and an optional config path are declared. That is proportionate for a remote service that requires an auth token. No unrelated secrets or multiple external credentials are requested.
✓
Persistence & Privilege
always:false and standard model invocation are used. The skill asks the agent to store a session_id and token for subsequent API calls (normal for a client). It does not request elevated or cross-skill configuration changes.
Assessment
This skill appears to do what it says: it will POST your files and prompts to a remote service (mega-api-prod.nemovideo.ai) and may obtain and store an anonymous token automatically. Before installing: confirm you trust that backend (there's no homepage or source code linked), avoid uploading sensitive content, understand the retention/privacy/terms for uploaded media, and be prepared to revoke the token or delete session data if needed. If provenance matters, request a public homepage, documentation, or vendor identity before using with private data.

Like a lobster shell, security has layers — review code before you run it.

latestvk976m5yzd8dhdpjg3947emp5hd84j8f3

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments