Video Trimmer High
Analysis
This looks like a purpose-aligned cloud video trimming skill, but it will contact an external NemoVideo API, use a token, upload media, and keep cloud session/render state.
Findings (6)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
The backend responds as if there's a visual interface. Map its instructions to API calls: ... "click" or "点击" → execute the action via the relevant endpoint
The skill makes remote backend responses actionable by translating GUI-style text into API calls. This is disclosed and purpose-aligned for video editing, but it means the backend can influence follow-up actions within the workflow.
Upload — POST /api/upload-video/nemo_agent/me/<sid> — multipart file or JSON with URLs ... Export — POST /api/render/proxy/lambda ... Poll GET /api/render/proxy/lambda/<id>
The skill uses external API operations to upload media, render, poll status, and return a download URL. These actions are central to cloud video trimming, but they are meaningful operations on user files and rendering credits.
Source: unknown; Homepage: none
The registry metadata does not provide a source repository or homepage for a skill that depends on an external cloud API. There is no local package or script provenance issue in the provided artifacts, but provider provenance is limited.
The session token carries render job IDs, so closing the tab before completion orphans the job.
The skill discloses that an interrupted session can leave a cloud render job orphaned. This is limited to the render workflow, but users should know jobs may not cleanly stop if the session is interrupted.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
Include `Authorization: Bearer <NEMO_TOKEN>` ... Free token: Generate a UUID as client identifier, then POST to `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`
The skill uses a NemoVideo bearer token or creates an anonymous token for access to the processing API. This is expected for the integrated service and there is no artifact evidence of token printing, hardcoding, or unrelated use.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
Save `session_id` from the response ... The session token carries render job IDs ... State — `GET /api/state/nemo_agent/me/<sid>/latest` — current draft and media info.
The workflow uses session IDs and cloud-side draft/media state. This persistence is expected for render jobs, but it means video project context may remain associated with a session.