by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's behavior mostly matches a cloud video-processing tool, but there are small inconsistencies and privacy implications (automatic token creation and filesystem checks) you should understand before installing.
评估建议
This skill uploads your videos to mega-api-prod.nemovideo.ai and requires a NEMO_TOKEN to operate. If you don't provide one it will automatically request an anonymous token from that domain and may cache it (7‑day expiry, 100 free credits per SKILL.md). Before installing, consider: (1) Are you comfortable sending your video content to this external service? (2) Do you consent to automatic token creation (the agent will call the service on your behalf)? (3) The skill will read its own frontmatter...详细分析 ▾
ℹ 用途与能力
The skill's name and description match its runtime instructions: it uploads videos to a cloud backend and returns rendered clips. One inconsistency: the registry metadata reported no required config paths, but the SKILL.md frontmatter lists a config path (~/.config/nemovideo/). That mismatch should be clarified but does not by itself break the declared purpose.
ℹ 指令范围
Instructions are focused on session creation, uploads, SSE editing, and exports to the stated backend (mega-api-prod.nemovideo.ai) — appropriate for video processing. Points to watch: the skill instructs the agent to (a) read the skill file frontmatter and detect the agent's install path to set X-Skill-Platform, and (b) poll and read session state. Those filesystem reads are limited and understandable for attribution, but they are broader than a purely stateless upload flow and should be disclosed to users.
✓ 安装机制
No install spec and no code files — instruction-only. This minimizes on-disk code risk; nothing in the manifest pulls binaries or external archives.
ℹ 凭证需求
The only declared credential is NEMO_TOKEN, which is proportional to a cloud video service. However, the SKILL.md instructs automatic acquisition of an anonymous token by POSTing to /api/auth/anonymous-token if NEMO_TOKEN is absent. That behavior is reasonable for convenience but has privacy implications (it will create/use an account-bound anonymous token and consume service credits). Also the SKILL.md references a config directory (~/.config/nemovideo/) which may be used to cache tokens; that should be made explicit.
✓ 持久化与权限
The skill is not always-enabled and does not request elevated platform privileges. It can be invoked autonomously (platform default), which is expected for skills, but it does not request permanent or cross-skill configuration changes.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/20
- Initial release of AI Shorts — generate short, vertical videos from long-form clips for TikTok and Reels creators. - Supports MP4, MOV, AVI, WebM files up to 500MB and outputs 1080p MP4 within 1–2 minutes using cloud GPUs. - Automatic setup with token generation and session management; 100 free credits on first use. - Simple workflow: upload video, describe the desired clip, and receive a ready-to-download result. - All key actions (upload, export, status, credits) are mapped to easy commands and handled via the cloud API. - Includes tips, error handling, and support for batch and iterative editing sessions.
● 无害
安装命令
点击复制官方npx clawhub@latest install ai-shorts
镜像加速npx clawhub@latest install ai-shorts --registry https://cn.longxiaskill.com