Cutter Online

• Risk level: Low
• Analyzed: Apr 17, 2026, 6:51 AM
• Findings: 0
• Version: 1.0.0

Overview

The skill's requests and runtime instructions are consistent with a cloud video-cutting service; the main oddities are minor metadata mismatches and the skill will obtain/store a short-lived anonymous token automatically if none is provided.

This skill appears to do what it says: it uploads user video files to a third-party API (mega-api-prod.nemovideo.ai), creates a short-lived token (or uses NEMO_TOKEN if provided), and returns rendered clips. Before installing or using it, consider: (1) privacy — uploaded videos will go to an external service; avoid sending sensitive content unless you trust the service and its retention policy; (2) token handling — the skill will auto-request and store an anonymous token valid ~7 days if you don't supply one; if you provide a token, treat it like a credential and rotate/revoke it if needed; (3) auto-connection — the skill may perform network calls on first-open; if you prefer explicit consent, require the skill to wait for user confirmation before contacting the backend; (4) metadata mismatch — the skill's frontmatter lists a config path that the registry summary did not; this looks like a packaging inconsistency and not an attack, but you may want the publisher to clarify where credentials/session data are persisted. If these behaviors are acceptable, the skill is coherent with its stated purpose.