ClawHub

Demo Clip Maker

v1.0.0

create raw footage into polished demo clips with this skill. Works with MP4, MOV, AVI, WebM files up to 500MB. marketers use it for generating short product...

⭐ 0· 55·0 current·0 all-time
by@whitejohnk-26
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
The name/description (create demo clips) match the declared requirement (NEMO_TOKEN) and the SKILL.md endpoints (nemovideo.ai). Requiring a single service token is proportionate for a cloud-rendering workflow.
ℹ
Instruction Scope
Instructions direct the agent to obtain/use NEMO_TOKEN, create sessions, upload user media, use SSE for edits, and poll export status — all aligned with video processing. The skill explicitly instructs reading its own YAML frontmatter and detecting install path (to set X-Skill-Platform), which requires access to the skill file and possibly probing common install paths in the user home directory; this is plausible for attribution but is broader filesystem access than strictly necessary.
✓
Install Mechanism
No install spec or code is present (instruction-only), so nothing is written to disk by an installer. This is the lowest-risk install mechanism.
ℹ
Credentials
Only NEMO_TOKEN is requested (primary credential), which fits a third-party API. The SKILL.md also explains how to obtain an anonymous token via the service API if NEMO_TOKEN is not provided — reasonable but means the skill can self-provision short-lived credentials without user-supplied secrets. There is a minor metadata discrepancy: the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) while the registry metadata reported no required config paths.
✓
Persistence & Privilege
The skill is not marked always:true and doesn't request persistent system privileges or to modify other skills. Autonomous invocation is allowed (platform default) but not combined with other concerning flags.
Assessment
This skill appears coherent for a cloud video-processing service, but consider these before enabling it: (1) Using the skill uploads your video files to https://mega-api-prod.nemovideo.ai — do not send sensitive or private footage unless you trust that domain and its privacy policy. (2) The skill can generate an anonymous NEMO_TOKEN itself, so it will call the external auth endpoint automatically if you don't provide a token. (3) The runtime asks the agent to read the skill's frontmatter and check common install paths (~/.clawhub, ~/.cursor, etc.), which requires limited filesystem access; ensure your environment policy allows this. (4) The package source and homepage are unknown and the owner ID is opaque — if you need stronger assurance, ask the publisher for a homepage, privacy policy, or official documentation and confirm the nemovideo.ai domain is legitimate. (5) If you have compliance or sensitive-data concerns, disable the skill or inspect outbound network activity / request logs before uploading real content.

Like a lobster shell, security has layers — review code before you run it.

latestvk973cz6t67hbtc4dkh3n73423h84nyv0

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments