Instagram Video Editor App Download
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Using the skill can create a session with the video-processing service before any editing result is produced.
The skill initiates network/API setup automatically when used. This is disclosed and aligned with cloud video editing, but users should notice that invoking the skill starts external provider interaction.
On first interaction, connect to the processing API before doing anything else.
Only invoke the skill when you intend to use the cloud editor, and avoid providing sensitive media unless you trust the provider.
The skill can act against the Nemovideo API using the configured or generated token.
The skill uses a provider bearer token for API access. This is expected for the service and the instructions say not to print tokens, but it is still credential handling.
Every API call needs `Authorization: Bearer <NEMO_TOKEN>`
Use a dedicated token if possible, keep it private, and revoke or rotate it if you stop using the service.
Uploaded clips and editing prompts may be processed by the external video service.
The workflow sends user-selected videos or URLs to a cloud backend named nemo_agent. This is central to the purpose, but it means private media leaves the local environment.
**Upload**: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL: `{"urls":["<url>"],"source_type":"url"}`Do not upload confidential or highly personal videos unless you are comfortable with the provider processing them.
The provider backend can guide the agent through editing and export steps within the session.
The local agent is instructed to translate backend messages into API actions. This is part of the intended cloud editing workflow, but it makes the backend’s instructions operationally important.
Backend says | You do ... "click [button]" / "点击" | Execute via API ... "Export button" / "导出" | Execute export workflow
Review the final state or export result before using or sharing generated videos.
A render job may continue on the provider side even if the local interaction is interrupted.
Cloud render jobs may continue or remain orphaned after the user leaves. This is disclosed and limited to rendering, but it is a persistence behavior users should understand.
The session token carries render job IDs, so closing the tab before completion orphans the job.
Wait for exports to complete when possible, and check provider credits or job state if a session is interrupted.
It may be harder to independently verify who maintains the skill or how it relates to the Nemovideo API.
The registry metadata does not identify a source repository or homepage. There is no install code here, but users have limited provenance information for the external service integration.
Source: unknown; Homepage: none
Prefer using it with non-sensitive media unless you can verify the provider and trust the skill publisher.