ClawHub

Video Editing With Online

v1.0.0

Cloud-based video-editing-with-online tool that handles editing videos directly in the browser without software. Upload MP4, MOV, AVI, WebM files (up to 500M...

⭐ 0· 63·0 current·0 all-time
by@tk8544-b
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
The name/description match the runtime instructions: the SKILL.md documents uploading video files, creating a session, and calling a named backend (mega-api-prod.nemovideo.ai) to render and export MP4s. Requesting a service token (NEMO_TOKEN) is proportionate to this purpose. One inconsistency: the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) while the registry metadata earlier stated 'Required config paths: none' — this mismatch should be clarified.
ℹ
Instruction Scope
All runtime actions are focused on the described backend API (auth, session creation, upload, SSE, render) and on sending user media to that service. The instructions also direct the agent to detect install path to set an X-Skill-Platform header (e.g., inspect ~/.clawhub/ or ~/.cursor/skills/), which implies reading local path information for attribution and could disclose local install paths. Otherwise the instructions do not request reading unrelated system files or additional credentials.
✓
Install Mechanism
There is no install spec and no code files — this is an instruction-only skill. That minimizes risk from third-party packages or arbitrary downloads.
ℹ
Credentials
The skill requires a single env var, NEMO_TOKEN, which is appropriate for an API-backed editing service. Minor concern: the SKILL.md frontmatter declares a config path (~/.config/nemovideo/) in metadata while the registry summary listed none — this inconsistency could indicate the skill expects to access a local config directory (read-only attribution) and should be confirmed.
✓
Persistence & Privilege
always:false and normal autonomous invocation are used. The skill does not request permanent presence or system-wide config changes and does not attempt to modify other skills' settings.
Assessment
This skill appears to do what it claims (upload your videos to mega-api-prod.nemovideo.ai and perform cloud rendering) and needs one token (NEMO_TOKEN). Before installing: (1) Confirm you trust the external service and its privacy policy — your videos and metadata will be sent to that API. (2) Do not reuse sensitive or unrelated credentials as NEMO_TOKEN (e.g., cloud provider keys). (3) Note the skill may generate an anonymous token by POSTing to the service if you don't provide NEMO_TOKEN; this is expected but results in outbound network calls. (4) The skill asks the agent to detect install path and set attribution headers — that can disclose local install path information; if that is a concern, request the author remove/install-path attribution or run in a sandbox. (5) Clarify the config-path mismatch (~/.config/nemovideo/) shown in the SKILL.md frontmatter vs registry metadata. If you don't recognize the skill owner or cannot verify the service, avoid providing your own token and consider running uploads through a separate, privacy-controlled workflow.

Like a lobster shell, security has layers — review code before you run it.

latestvk975hwaey3vxqs61dq44kphg1h84m539

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments