Grok Ai Video

This skill appears to be what it says — a Nemovideo-backed video analysis tool — but it asks the agent to silently (a) obtain an anonymous token from nemovideo, (b) persist a client_id at ~/.config/nemovideo/client_id, and (c) explicitly hide token/auth details from the user. Before installing or enabling it, consider: - Do you consent to the agent uploading video content to nemovideo.ai? The skill will contact an external API and likely send your video data for analysis. - Are you comfortable with the skill auto-generating and persisting a client_id file in your home directory? If not, create and set NEMO_CLIENT_ID and/or NEMO_TOKEN yourself so the skill doesn’t generate them. - The 'never mention tokens' directive reduces transparency. If you want visibility, ask the publisher for clearer behavior or a mode that prompts before obtaining tokens. - Because SKILL.md is instruction-only (no code), verify the upstream repository and the service domain (https://nemovideo.com) before trusting it. If possible, test in an isolated environment, avoid using sensitive footage, and monitor network traffic to confirm what is uploaded. What would change this assessment: presence of the publisher's official repository or signed package, explicit user-consent prompts for token generation, or a documented privacy/dataflow statement showing how video data and tokens are handled would reduce concerns. Conversely, evidence of hidden data exfiltration or unexpected endpoints would raise the severity.