Caption Ai
v1.0.0Turn a 3-minute YouTube tutorial recording into 1080p captioned videos just by typing what you need. Whether it's adding auto-generated subtitles to videos o...
⭐ 0· 54·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill name/description (auto-generate captions, upload video, export MP4) match the only required credential (NEMO_TOKEN) and the API endpoints the instructions use. The SKILL.md metadata also references a local config path (~/.config/nemovideo/) and reading the skill frontmatter/install path for attribution headers — these are plausible for a client that wants to include provenance and local config, though not strictly necessary.
Instruction Scope
Runtime instructions are explicit about connecting to the nemovideo.ai API, creating or consuming NEMO_TOKEN, creating a session, uploading local video files (multipart or URL), polling render status, and returning download URLs. The skill also instructs the agent to read this file's YAML frontmatter and detect the agent install path (~/.clawhub/, ~/.cursor/skills/) for attribution headers; and to consider a local config path (~/.config/nemovideo/). Those file reads are limited in scope (skill metadata and possible service config) but are outside pure captioning logic and could expose small amounts of local config if present. The instructions do not request any unrelated system credentials or arbitrary file reads beyond these.
Install Mechanism
No install spec or remote code downloads are present (instruction-only skill). There is no package installation, archive extraction, or external binary download — lowest risk in this dimension.
Credentials
Only one environment credential is declared (NEMO_TOKEN) which is appropriate for a cloud API client. The skill will also create an anonymous token via the service's anonymous-token endpoint if NEMO_TOKEN is absent. The SKILL.md metadata mentions a local config path which could contain service credentials; the agent instructions imply reading it for configuration/attribution. That is plausible but worth noting: providing NEMO_TOKEN or allowing the skill to read ~/.config/nemovideo/ grants access to the associated account and any stored tokens/config.
Persistence & Privilege
The skill is not marked always:true and has no install-time code; it does not request persistent system-wide changes or modify other skills. Autonomous invocation is allowed (platform default) but not combined with high privilege or extra credentials.
Assessment
This skill appears to do what it says: it uploads videos to nemovideo.ai, uses NEMO_TOKEN (or obtains an anonymous token) to create a session, and returns a processed video URL. Before installing or using it: (1) be aware that your video files and any metadata are sent to an external service (https://mega-api-prod.nemovideo.ai); don't upload sensitive video you don't want transmitted. (2) Providing NEMO_TOKEN or allowing the skill to read ~/.config/nemovideo/ grants access to your account on that service — prefer a scoped/disposable token if possible. (3) The skill reads its own frontmatter and may detect install paths to add attribution headers — this is harmless but means the skill may read small local config/metadata files. (4) If you have privacy or compliance concerns, test with non-sensitive videos and consider creating an anonymous/free token rather than exposing a long-lived account token. If you want further assurance, ask the publisher for a privacy/TOS statement or for an installable client from a known homepage (none is provided here).Like a lobster shell, security has layers — review code before you run it.
latestvk973fn28jav1wdr7fpr5csnr0x84m888
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
💬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN