by 安全扫描
OpenClaw
安全
high confidence该技能声明的需求与运行时指令与其既定目的相符：它使用 NEMO API 令牌将用户视频文件上传并在第三方云服务上渲染；所请求的内容与该任务相比并不过分。
评估建议
This skill will upload any video you send to a third-party service (mega-api-prod.nemovideo.ai) and uses a NEMO API token (or an anonymous token the skill can request) to operate. Before installing or using it, consider: (1) Do you trust the service and owner to process and store your videos? Avoid uploading sensitive or private footage unless you accept that it will leave your device. (2) The skill can create and store a short-lived anonymous token (100 credits, 7 days) — treat NEMO_TOKEN like ...详细分析 ▾
✓ 用途与能力
The skill is a cloud-based video cutting service and only requests a single API credential (NEMO_TOKEN) and an optional config path (~/.config/nemovideo/) consistent with a client for that service. Required binaries and install steps are absent, which matches an instruction-only cloud-integrator skill.
ℹ 指令范围
Runtime instructions focus on authenticating (optional anonymous token endpoint), creating a session, uploading videos (multipart or URL), starting render jobs, polling status, and downloading results. The instructions explicitly tell the agent not to print tokens. They also instruct the agent to read this file's YAML frontmatter and to detect its install path (to set X-Skill-Platform) — reading those local metadata/paths is plausible but not strictly necessary for core functionality and will require the agent to inspect its runtime environment.
✓ 安装机制
No install spec or downloadable artifacts are present; this is instruction-only, so nothing is written to disk by an installer. That is the lowest-risk installation footprint.
✓ 凭证需求
Only one credential (NEMO_TOKEN) is required and it is the primary credential needed to call the indicated API endpoints. The manifest's configPaths entry (~/.config/nemovideo/) could grant access to local config but is consistent with a client that might store tokens or settings there. No unrelated secrets or multiple external credentials are requested.
✓ 持久化与权限
The skill is not forced-always, and autonomous invocation is allowed by platform default. It does not request elevated or cross-skill configuration changes. There is no install-time modification of other skills or persistent privileged presence.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/19
ai-product-video-cutter v1.0.0 – 首次发布：利用 AI 一键把电商产品长视频剪成高光片段，无需手动编辑。 - 上传原始素材（MP4、MOV、AVI、WebM，最大 500MB）。 - 极简流程：上传 → 请求高光片段（如“剪出最佳 30 秒”）→ 约 1 分钟下载 1080p MP4。 - 无需安装，云端 GPU 处理。 - 专为追求极速、零操作的视频裁剪需求的电商营销人员设计。
● 无害
安装命令
点击复制官方npx clawhub@latest install ai-product-video-cutter
镜像加速npx clawhub@latest install ai-product-video-cutter --registry https://cn.longxiaskill.com