Vheer

What to consider before installing/using Vheer: - The skill is consistent with a cloud video-analysis service and only asks for one credential (NEMO_TOKEN). That part is expected. - It will create or read ~/.config/nemovideo/client_id and use the NemoVideo API to upload and analyze videos. If you plan to analyze sensitive or confidential footage, understand NemoVideo's privacy, retention, and access policies before uploading. - The runtime instructions build a workspace 'claim' URL that embeds your token as a query parameter. Even though the skill says not to print tokens, embedding a token in a URL can leak it via logs, browser history, or shared links. Prefer to set NEMO_TOKEN yourself (in the environment) rather than allowing the skill to create/use an anonymous token you might later share. - The skill detects install/platform paths (e.g., ~/.clawhub, ~/.cursor/skills). This requires checking common directories on the host; if you are uncomfortable with that, avoid installing or review how your agent exposes filesystem checks. - Mitigations: if you proceed, pre-create a limited-scope NEMO_TOKEN (or use the anonymous token but treat any claim link as sensitive), never share claim links, and remove or rotate tokens after use. Review network traffic and API endpoints if you need stronger assurance. Confidence is medium because the skill is coherent for its stated purpose, but the token-in-URL behavior and filesystem checks are notable risks that should be addressed or acknowledged by the publisher before trusting with sensitive data.