Compressor Ios

PassAudited by VirusTotal on May 3, 2026.

Overview

Type: OpenClaw Skill Name: compressor-ios Version: 1.0.0 The compressor-ios skill is a cloud-based video processing tool that facilitates MP4 compression via the nemovideo.ai API. The SKILL.md provides transparent instructions for authentication (including an anonymous token fallback), file uploading, and session management. All network activity is directed to the stated backend (mega-api-prod.nemovideo.ai), and the skill does not attempt to access sensitive local data (e.g., SSH keys, AWS credentials) or execute unauthorized system commands. The behavior is entirely consistent with its stated purpose as a video compression utility.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill can use or create a NemoVideo session token to process videos and check credits/session state.

Why it was flagged

The skill uses a bearer token or creates an anonymous starter token to access the NemoVideo API. This is expected for the cloud service, but it is still delegated service authority.

Skill content
If `NEMO_TOKEN` is in the environment, use it directly and create a session. Otherwise, acquire a free starter token... POST to `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`
Recommendation

Use a token you are comfortable delegating to this skill, monitor credits if relevant, and avoid sharing the token outside the agent environment.

What this means

Uploaded videos, prompts, and generated outputs may be processed and temporarily stored by the NemoVideo backend.

Why it was flagged

The skill sends user-provided video/media content to a remote backend for processing. This is central to the stated purpose, but it involves sharing potentially private media with a third-party service.

Skill content
Drop your video files in the chat and tell me what you need. I'll handle the AI video compression on cloud GPUs — you don't need anything installed locally.
Recommendation

Only upload media you are comfortable sending to the external service, and be careful with private or sensitive videos.

What this means

The backend may guide the agent to run upload, edit, state, or export calls as part of the compression workflow.

Why it was flagged

The remote backend can return GUI-like instructions that the agent translates into API actions. The actions appear constrained to the video workflow, but backend-directed tool use is worth noticing.

Skill content
Backend says | You do | "click [button]" / "点击" | Execute via API ... "Export button" / "导出" | Execute export workflow
Recommendation

Confirm important actions such as exporting or using private files, and review the final output before sharing it.

What this means

Users have less independent context for verifying who operates or maintains the service behind the skill.

Why it was flagged

The skill has limited provenance metadata. There is no local code or install script to inspect, but users must still trust the external NemoVideo service endpoint documented in the skill.

Skill content
Source: unknown
Homepage: none
Recommendation

Install/use the skill only if you trust the publisher and the nemovideo.ai backend it contacts.