Video Maker Guru Free
PassAudited by VirusTotal on May 5, 2026.
Overview
Type: OpenClaw Skill Name: video-maker-guru-free Version: 1.0.0 The skill is a functional integration for a video editing service hosted at nemovideo.ai. It provides the AI agent with detailed instructions for managing authentication (including an anonymous token flow), file uploads, and video processing via a remote API. While it includes logic for environment fingerprinting (detecting the installation path to set attribution headers) and manages API tokens, these behaviors are transparently documented and align with the stated purpose of providing a cloud-based video editing tool. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Videos, audio, images, URLs, and editing instructions may be processed by a third-party provider.
The skill sends user prompts and uploaded media to an external cloud video service.
**API base**: `https://mega-api-prod.nemovideo.ai` ... **Send message (SSE)**: POST `/run_sse` ... **Upload**: POST `/api/upload-video/nemo_agent/me/<sid>`
Only upload media you intend to share with NemoVideo, and avoid sensitive or confidential footage unless you trust that provider's privacy practices.
The agent may act under a NemoVideo token and may consume credits or create cloud sessions tied to that token.
The skill uses an existing provider token or creates an anonymous token to authorize sessions and rendering actions.
If `NEMO_TOKEN` is in the environment, use it directly ... Otherwise, acquire a free starter token ... POST to `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`
Use a scoped or disposable token where possible, and monitor any credits or account activity associated with the service.
If backend instructions are over-trusted, the agent could perform service actions that were not clearly requested by the user.
Backend responses can direct the agent to perform follow-up API actions.
The backend responds as if there's a visual interface. Map its instructions to API calls: ... `click` ... → execute the action via the relevant endpoint
Keep backend-directed actions limited to the current user-requested video workflow and ask before uploads, exports, purchases, or other impactful actions.
A user may expect the workflow to be entirely free, then encounter credit, registration, or subscription limitations after uploading or editing media.
The skill is framed as free, but the instructions also describe credit limits and possible registration or upgrade requirements.
`**Export** (free, no credits)` ... `402 | Free plan export blocked | ... Register or upgrade your plan to unlock export.`
Clearly disclose credit limits, token expiration, and any upgrade requirements before the user invests time or uploads content.
Users have less provenance information when deciding whether to trust a skill that handles media uploads and provider tokens.
The registry metadata does not provide a verifiable source or homepage for the skill.
Source: unknown; Homepage: none
Prefer skills with clear publisher identity, documentation, and a privacy policy, especially for cloud processing of personal media.
A render may continue server-side or become inaccessible if the session is interrupted.
Cloud render jobs may continue or become detached from the local session if the user leaves before completion.
The session token carries render job IDs, so closing the tab before completion orphans the job.
Wait for renders to complete when possible, and the skill should provide clear status or cancellation guidance for long-running jobs.