Shorts Video
PassAudited by VirusTotal on May 6, 2026.
Overview
Type: OpenClaw Skill Name: shorts-video Version: 1.0.0 The skill provides a legitimate interface for a cloud-based video editing service hosted at nemovideo.ai. It manages API sessions, file uploads, and rendering tasks through standard HTTP requests and SSE streams as described in SKILL.md. While it handles authentication tokens and performs network communication, these actions are strictly aligned with the stated purpose of video processing and do not exhibit signs of data exfiltration, malicious execution, or unauthorized system access.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent can act within the NemoVideo service using the provided or generated token, including actions that may consume credits.
The skill uses an existing service token or obtains an anonymous token to create sessions and spend service credits; this is expected for the integration but crosses an account/credential boundary.
If `NEMO_TOKEN` is in the environment, use it directly and create a session. Otherwise, acquire a free starter token...
Use a dedicated or limited NemoVideo token when possible, and monitor credit usage for exports.
Private videos, images, audio, file URLs, and edit prompts may leave the local device and be processed by NemoVideo.
The skill is designed to send user media and related editing instructions to a third-party cloud service for processing.
Send me your raw video footage... The AI short-form editing runs on remote GPU nodes... `/api/upload-video/nemo_agent/me/<sid>` | POST | Upload a file (multipart) or URL.
Only upload media you are allowed and comfortable sharing with the remote service, and review the provider's privacy and retention terms if the content is sensitive.
Backend responses can cause edits, state changes, or exports inside the NemoVideo session, potentially consuming credits or changing the project.
The agent is instructed to convert backend stream/UI-style responses into API actions, including project operations and export actions; this is core to the workflow but gives the backend influence over action sequencing.
Backend says ... "click [button]" ... Execute via API ... "Export button" / "导出" | Execute expo
Keep upload and export actions tied to clear user requests, and confirm any ambiguous credit-consuming or final export step.
Users have less independent context for verifying the publisher or service before sending media to the backend.
The registry metadata provides limited provenance for a skill that connects to a third-party backend, though no local code or install script is present.
Source: unknown; Homepage: none
Verify the service and publisher independently before using the skill with sensitive or proprietary footage.