Spicy Ai Video Maker
v1.0.0Turn your ideas, scripts, or raw clips into scroll-stopping videos using spicy-ai-video-maker — the AI skill built for creators who want edge, energy, and st...
⭐ 0· 52·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name and description (AI video creation) align with the declared requirement for a NEMO_TOKEN and the SKILL.md instructions that connect to a nemo video backend. The declared config path (~/.config/nemovideo/) and primaryEnv NEMO_TOKEN are coherent with a client that talks to a remote rendering service.
Instruction Scope
Instructions instruct the agent to check for NEMO_TOKEN, create an anonymous token via an external endpoint if missing, create/hold sessions, stream generation via SSE, and upload user-provided files (multipart/form-data or URLs). The skill also directs the agent to read its install path to set X-Skill-Platform attribution headers and references a local config path. These behaviors are expected for a cloud video service but mean the agent will read supplied local file paths and transmit them to the remote API—so there is an inherent data-exfiltration/privacy risk if you provide sensitive files or environment secrets.
Install Mechanism
Instruction-only skill with no install spec and no code files. Nothing is downloaded or written by an installer as part of skill installation (lower filesystem/install risk).
Credentials
Only one environment variable is declared (NEMO_TOKEN), which is appropriate for a service that requires an API token. The skill will also obtain an anonymous token automatically if NEMO_TOKEN is absent. The declared config path is service-specific. No unrelated credentials or broad environment access are requested.
Persistence & Privilege
Skill is not marked always:true and does not request persistent system-level privileges. It keeps session_ids for operation during a session (normal). It does not appear to modify other skills or global agent configuration.
Assessment
This skill appears to do what it says (connect to nemo video backend, stream responses, and upload media). Important things to consider before installing: 1) it will call https://mega-api-prod.nemovideo.ai and upload any files you instruct it to send — do not upload sensitive or private files unless you trust the service and its retention policy; 2) if you set NEMO_TOKEN as an env var, treat it like any API key (don’t reuse highly privileged credentials); 3) the skill will create an anonymous token for you if no token is present, which may create usage tied to that token for ~7 days — if you want to revoke access later, check the service’s token/account controls; 4) the skill reads its install path and a service config directory for attribution—if you are concerned about local path disclosure, avoid installing or supplying path-sensitive inputs; 5) the skill source is unknown and there is no homepage or code to review—if you need stronger assurance, ask the publisher for a source repo or privacy/retention policy before using. If you proceed, avoid sending secrets or private data to the service and consider using throwaway/limited tokens.Like a lobster shell, security has layers — review code before you run it.
latestvk97924w3g3g2z2j0ab46x0az6d84f6gz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🌶️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
