ClawHub

Free Video Maker

v1.0.0

Drop your clips, photos, or a simple idea and watch it transform into a polished video — no software installs, no subscriptions. This free-video-maker skill...

⭐ 0· 41·0 current·0 all-time
by@udnerc
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (video creation) align with the declared env var (NEMO_TOKEN) and the SKILL.md API endpoints (mega-api-prod.nemovideo.ai). No unrelated cloud providers or unrelated credentials are requested.
ℹ
Instruction Scope
Instructions are focused on session creation, SSE, uploads, credits, and export. They require reading NEMO_TOKEN from environment and include a fallback anonymous-token request to the same nemo API. The skill also suggests detecting the install path (~/.clawhub, ~/.cursor/skills) to populate an X-Skill-Platform header — this requires the agent to check local paths, which is minor but not strictly necessary for core functionality.
✓
Install Mechanism
No install spec or downloadable artifacts — instruction-only skill. This minimizes on-disk execution risk.
✓
Credentials
Only one credential (NEMO_TOKEN) is declared as required/primary. The SKILL.md explains a legitimate anonymous-token fallback for users without a token. No other secrets or config paths are requested.
✓
Persistence & Privilege
Skill is not always-enabled and does not request elevated or persistent system privileges. It does not modify other skills or system-wide settings in the instructions.
Assessment
This skill is coherent with its stated purpose: it uploads your media and orchestrates cloud rendering on nemo's API. Before using it, consider: - You will be sending your media to https://mega-api-prod.nemovideo.ai (confirm you trust that service and its privacy/retention rules). - You can provide your own NEMO_TOKEN or the skill will obtain a short-lived anonymous token (100 free credits, 7-day expiry) by calling the service — anonymous tokens still involve network calls to the provider. - The skill may check local install paths to set an attribution header (this reveals presence/paths of certain agent runtimes but not file contents). If you don’t want that, insist the agent skip platform detection or set the header to "unknown". - There is no installable code to audit beyond the SKILL.md; behavior is determined by these instructions and the remote API. If you need stronger guarantees, verify the provider's documentation or run uploads through a disposable account/token.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ey8xcq4x0v00qda9062vmjn841r78

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments