by 安全扫描
OpenClaw
可疑
medium confidence该技能作为第三方视频生成 API（NEMO）的指令包装，用于生成供应链解释视频。注意：存在元数据不一致，且明确指令传输潜在敏感供应链数据到外部端点 — 安装前请审查。
评估建议
["确认 API 域（mega-api-prod.nemovideo.ai）和供应商身份/条款/隐私政策 — 确保您信任他们处理潜在机密的采购和财务数据。","澄清关于 ~/.config/nemovideo/ 的元数据不匹配（注册表 vs SKILL.md）。","仅提供适当范围的令牌（最小权限），避免在 API 负载中发送高度敏感的 PII 或秘密。","考虑使用测试数据进行初始运行，并在怀疑滥用时旋转/撤销令牌。","如果需要更强的保证，请在使用前向发布者请求官方主页、文档或隐私/安全 SLA。"]...详细分析 ▾
ℹ 用途与能力
Name/description (create explainer videos) aligns with the single required credential (NEMO_TOKEN) and the provided curl example that calls a nemovideo API. However, SKILL.md metadata declares a config path (~/.config/nemovideo/) while the registry metadata shown above lists no required config paths — this mismatch should be clarified.
⚠ 指令范围
SKILL.md is instruction-only and explicitly instructs the agent to POST user-provided process details and goals to https://mega-api-prod.nemovideo.ai/api/v1/generate with Authorization: Bearer $NEMO_TOKEN. That is expected for a cloud video service, but it also means potentially sensitive procurement/financial/process data will be sent to a third party. The instructions do not attempt to read other local files or extra environment variables, which is good, but the data‑exfiltration risk (sending confidential business info) is real and should be considered.
✓ 安装机制
No install spec and no code files — lowest risk for installation. The skill is instruction-only and therefore does not write code to disk during install.
ℹ 凭证需求
Only one env var is required (NEMO_TOKEN) and it's used directly in the provided curl example, which is proportionate for a cloud API. The SKILL.md metadata references a config path (~/.config/nemovideo/) not reflected in the registry metadata — this inconsistency should be resolved. No unrelated credentials are requested.
✓ 持久化与权限
always:false and default autonomous invocation settings (disable-model-invocation:false) — the skill can be invoked by the agent but is not force-included. This is typical; no elevated or persistent privileges are requested.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/5
供应链解释视频的初始发布。- 为商业和教育用途创建定制的供应链过程动画解释视频。- 以简单语言可视化复杂的采购、库存和物流流程，用于高管演示、培训和销售。- 导出视频用于利益相关者沟通、供应商 RFP、入职和课程开发。- 简单 API：描述您的过程、受众和目标以生成澄清操作的视频。
● 无害
安装命令 点击复制
官方npx clawhub@latest install supply-chain-explainer-video
镜像加速npx clawhub@latest install supply-chain-explainer-video --registry https://cn.clawhub-mirror.com
技能文档
用例
- 高管利益相关者演示 — 为 CFO 和 CEO 制作理解供应链转型投资的动画比较视频。
- 供应链技术销售 — 为运营团队展示软件解决供应链痛点的动画视频。
- 供应商和合作伙伴入职 — 为新供应商创建标准化入职视频。
- 运营培训和变更管理 — 实现新系统的角色特定过程演示视频。
如何工作
描述您的供应链过程、目标受众和通信目标，供应链解释视频将创建一个动画过程可视化或解释视频，使您的运营故事易于理解。curl -X POST https://mega-api-prod.nemovideo.ai/api/v1/generate \
-H "Authorization: Bearer $NEMO_TOKEN" \
-H "Content-Type: application/json" \
-d '{"skill": "supply-chain-explainer-video", "input": {"process": "omnichannelulfillment", "audience": "executive stakeholders", "goal": "approve $2M WMS investment"}}'
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制