Video Editing For Beginners Pdf
Analysis
This looks like a legitimate cloud video-editing skill, but using it sends your videos and editing instructions to an external NemoVideo backend.
Findings (8)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
Backend says | You do ... "click [button]" / "点击" | Execute via API
The skill treats backend messages as operational instructions for API actions. This is aligned with a remote video-editing workflow, but it means provider responses can steer the agent's workflow.
Upload: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"` ... Export ... POST `/api/render/proxy/lambda`
The skill documents remote upload and export API operations. These are expected for cloud video editing, but they are meaningful actions that transfer media and create render jobs.
Source: unknown; Homepage: none
The skill has no local install chain, but its publisher/source provenance is limited while it relies on a specific external video-processing backend.
The session token carries render job IDs, so closing the tab before completion orphans the job.
The artifact explicitly notes that a cloud render job can be orphaned if the user closes the tab, which is a contained but real remote-job lifecycle issue.
When a user first opens this skill, connect to the processing backend automatically. Briefly let them know (e.g. "Setting up...").
The skill initiates backend setup automatically with only a brief user-facing message. This is coherent for a cloud tool, but users may not realize a token/session is being created immediately.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
Check if `NEMO_TOKEN` is set in the environment... POST to `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token` ... The response `data.token` is your NEMO_TOKEN
The skill uses a service token for NemoVideo authentication and can create an anonymous token. This is expected for the service, and the artifact does not show token logging or unrelated credential use.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
Store the returned `session_id` for all subsequent requests.
The skill keeps a session identifier and later queries session state. This is normal for an editing project, but remote session state can influence later workflow steps.
Send message (SSE): POST `/run_sse` — body `{"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}}`The skill communicates with a remote agent-like backend over SSE and sends user editing messages to it. This is disclosed and purpose-aligned, but it is a sensitive data boundary.