Video Editing With Clipchamp
ReviewAudited by ClawScan on May 10, 2026.
Overview
Review recommended because the skill is branded as Clipchamp but sends uploaded videos and edit requests to a NemoVideo cloud backend.
Before installing, confirm you are comfortable with this not appearing to use Microsoft Clipchamp directly and with your uploaded media being processed by the NemoVideo backend. Avoid uploading private or regulated videos unless you trust the provider and understand its retention and privacy practices.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user could believe their media is being handled by Clipchamp while it is actually sent to a different cloud service.
The user-facing name suggests Clipchamp, but the operational instructions use a NemoVideo backend instead. That mismatch matters because users may choose to upload private videos based on the apparent service identity.
displayName: "Video Editing with Clipchamp — Edit and Export Videos Fast" ... "All calls go to `https://mega-api-prod.nemovideo.ai`."
Rename or describe the skill to accurately identify the backend provider, clearly state any non-affiliation with Clipchamp, and ask for user consent before uploading media.
Uploaded videos, audio, images, or URLs may leave the local environment and be processed by the provider.
The skill is designed to send user-provided media files or media URLs to a third-party cloud API for processing. This is purpose-aligned, but videos can contain sensitive personal or business information.
"Drop your video clips in the chat" ... "AI video editing on cloud GPUs" ... "Upload — `POST /api/upload-video/nemo_agent/me/<sid>` — multipart file or JSON with URLs."
Only upload media you are comfortable sending to the disclosed backend, and the publisher should document retention, deletion, and privacy handling for uploaded files.
Anyone who obtains the token could potentially use the associated credits or access the related session during its validity period.
The skill uses a bearer token to authorize video-editing sessions and may create an anonymous token automatically if one is not present. This is expected for the cloud service but is still an account/session credential.
Check if `NEMO_TOKEN` is set ... POST to `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token` ... `data.token` is your NEMO_TOKEN — 100 free credits, valid 7 days.
Keep the token out of chat logs and shared screenshots, and revoke or rotate it if exposed.
Export requests may use service credits and create remote render jobs when the user asks to export.
The skill instructs the agent to trigger remote render jobs and poll for completion. That matches the video-export purpose, but it can consume provider credits or create cloud jobs.
"Export" or "导出" → run the export workflow ... "Export — `POST /api/render/proxy/lambda` ... Poll `GET /api/render/proxy/lambda/<id>` every 30s"
Show credit/cost implications before rendering when possible, especially for larger videos.
Users have less information to verify who operates the skill or backend.
The registry metadata does not provide a clear source or homepage, while the skill relies on a third-party cloud API. This limits provenance review.
Source: unknown; Homepage: none
Provide a publisher homepage, source information, and clear backend ownership/privacy documentation.