Video Clip Generator

ReviewAudited by ClawScan on May 11, 2026.

Overview

This appears to be a legitimate cloud video-editing skill, but it will create or use a NemoVideo token/session and upload selected videos and prompts to a third-party API.

Install this only if you are comfortable using NemoVideo's cloud API for editing. Do not upload private or confidential footage unless you accept the provider handling it, and keep the NEMO_TOKEN secret.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill can create a remote NemoVideo session before any editing work begins.

Why it was flagged

The skill instructs the agent to initiate a remote API session automatically when the skill is used. This is expected for a cloud video editor, but users should know the skill contacts a third-party service as part of setup.

Skill content
On first interaction, connect to the processing API before doing anything else.
Recommendation

Use the skill only when you intend to process video through NemoVideo, and avoid invoking it for unrelated chats.

What this means

The agent may perform editing, state-query, upload, or export API calls as part of following the provider workflow.

Why it was flagged

The remote backend's GUI-style responses are used to drive API actions. This is part of the intended cloud editor workflow, but it means backend responses influence what actions the agent performs within the session.

Skill content
Map its instructions to API calls: - "click" or "点击" → execute the action via the relevant endpoint ... - "Export" or "导出" → run the export workflow
Recommendation

Keep requests specific and review resulting edits/exports, especially before sharing generated clips.

What this means

Anyone with access to the token may be able to use the associated NemoVideo credits or sessions.

Why it was flagged

The skill uses a bearer token to access the NemoVideo API. This credential use is expected for the service and the artifact also says not to print tokens, but the token can authorize account/session actions.

Skill content
Every API call needs `Authorization: Bearer <NEMO_TOKEN>`
Recommendation

Use a dedicated token if possible, keep NEMO_TOKEN private, and rotate it if you suspect it was exposed.

What this means

Uploaded footage and editing prompts may be processed and stored by the third-party video service.

Why it was flagged

The skill sends user-selected video files or URLs to the NemoVideo cloud API for processing. This is central to the skill's purpose, but raw footage may contain private or sensitive content.

Skill content
**Upload**: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL: `{"urls":["<url>"],"source_type":"url"}`
Recommendation

Upload only videos you are comfortable sending to NemoVideo, and avoid footage containing sensitive personal, business, or confidential information unless that is acceptable under the provider's terms.

What this means

Users have less information for verifying who operates the integration or where to review provider documentation.

Why it was flagged

The registry metadata does not provide a public source or homepage for additional provenance review. The skill is instruction-only, so this is not evidence of malicious code, but it limits independent verification.

Skill content
Source: unknown; Homepage: none
Recommendation

Confirm you trust the listed provider endpoint and token workflow before uploading private media.