by 安全扫描
OpenClaw
可疑
medium confidenceThe skill’s claimed purpose (remote subtitle/rendering) matches most of its instructions and the single requested credential (NEMO_TOKEN), but there are small inconsistencies and some behaviors you should explicitly understand before installing (file uploads to a third‑party service, metadata disagreement about config paths, and implicit filesystem probing to determine install path).
评估建议
Before installing, understand this will upload your videos (and likely metadata) to mega-api-prod.nemovideo.ai for server-side processing — if your content is sensitive, do not proceed without checking the service's privacy/security terms. Confirm whether you trust the Nemo service and whether you prefer to use an anonymous, short‑lived token (the skill documents how to obtain one). Ask the publisher to resolve the metadata inconsistency about config paths (SKILL.md frontmatter lists ~/.config/n...详细分析 ▾
ℹ 用途与能力
The skill advertises server-side subtitle generation and the SKILL.md shows APIs to upload videos, create sessions, and request renders — this aligns with the stated purpose. The required credential (NEMO_TOKEN) is appropriate for access to the described API. However, the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) while the registry metadata earlier reported no required config paths — an internal inconsistency worth clarifying.
ℹ 指令范围
Runtime instructions explicitly direct the agent to upload user video files and to POST/GET to mega-api-prod.nemovideo.ai endpoints (session creation, upload, SSE chat, render polling). That is expected for this function, but it does mean user media and derived metadata are transmitted off‑device to a third‑party service. The SKILL.md also prescribes deriving an X-Skill-Platform header by inspecting install paths (e.g., ~/.clawhub/ or ~/.cursor/skills/) — that implies the agent might read the filesystem to detect install location, which is not strictly necessary to provide core functionality and should be explained/justified.
✓ 安装机制
Instruction-only skill with no install spec or code files — lowest install risk. No downloads or extracted archives are specified.
ℹ 凭证需求
Only NEMO_TOKEN is declared as required (primary credential), which matches the described API usage. The frontmatter also references a config path (~/.config/nemovideo/) that would grant access to local config if the agent reads it — the top-level registry summary listed no required config paths, so that discrepancy should be resolved. The skill advises generating an anonymous token if none is present (reasonable), and it instructs not to print tokens.
✓ 持久化与权限
No always:true, no install-time persistence requested, and the skill does not claim to modify other skills or system-wide settings. Autonomous invocation is allowed (platform default) but not a separate concern here.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/26
Initial release of AI Subtitle Generator Free. - Instantly generate and embed subtitles into videos up to 3 minutes long, with fast cloud-based processing (30–60 seconds). - Upload your video files and use plain language prompts to add captions, export to 1080p MP4, and more—no timeline editing or export settings needed. - Supports free, anonymous sessions with automatic API connection and 100 credits per token (7-day expiry). - Guides available for common workflows and troubleshooting, including format support and credit management. - Comprehensive error handling and user feedback for upload limits, expired tokens, rate limits, and export restrictions.
● 无害
安装命令
点击复制官方npx clawhub@latest install ai-subtitle-generator-free
镜像加速npx clawhub@latest install ai-subtitle-generator-free --registry https://cn.longxiaskill.com