by 安全扫描
OpenClaw
可疑
medium confidence该技能的行为基本等同于远程视频渲染服务，但声明的需求存在不一致，且运行时指令会导致用户文件和 auth token 被发送至第三方 API——安装前请确认厂商可信及 token 处理是否符合预期。
评估建议
This skill will upload whatever video/image files the user supplies to mega-api-prod.nemovideo.ai and will create or use a NEMO_TOKEN to interact with that service. Before installing or using it: 1) Confirm you trust the remote domain and its privacy/retention policy — do not upload sensitive footage unless you are sure. 2) Ask the skill author how NEMO_TOKEN is stored, whether anonymous tokens persist locally or on the service, and how long uploads are retained. 3) Note the metadata mismatch: t...详细分析 ▾
ℹ 用途与能力
The skill claims to produce YouTube-ready videos and its API calls and upload steps align with that purpose. However, the registry metadata (no required config paths) conflicts with the SKILL.md frontmatter which lists ~/.config/nemovideo/ as a config path. Also NEMO_TOKEN is declared as required but the runtime instructions include an anonymous-token acquisition flow if no token is present — this mismatch should be clarified.
⚠ 指令范围
The instructions direct the agent to obtain an anonymous token from a remote endpoint, create a session, upload user-supplied files (multipart file uploads or URLs), stream SSE data, poll render endpoints, and read the skill's YAML frontmatter and install path to set attribution headers. Uploading user files and actively generating/authenticating tokens are within a video service's needs, but they also introduce remote data transfer and token management that the SKILL.md does not fully describe (e.g., where tokens are stored, for how long, or whether uploads are retained).
✓ 安装机制
Instruction-only skill with no install spec or code files; nothing is written to disk by an installer. This minimizes install-time risk.
ℹ 凭证需求
Only NEMO_TOKEN is declared as the primary credential, which is appropriate for a cloud service. But the SKILL.md both expects NEMO_TOKEN and provides a flow to fetch an anonymous token if missing — the registry requiring the env var while runtime supports auto-provisioning is inconsistent. The SKILL.md also references reading install paths and the skill's YAML frontmatter to populate headers; these are plausible but should be documented.
✓ 持久化与权限
The skill is not always-on and does not request system-wide privileges. It does not declare writing other skills' configs. Note: autonomous invocation (default) remains enabled — combine this with the remote upload/token behavior when deciding trust.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/19
AI Video Maker for YouTube — 首发版 - 上传片段或图片，1–2 分钟生成含片头、转场、背景音乐的 YouTube 就绪视频 - 支持最大 500 MB 文件（MP4、MOV、AVI、WebM），云端 GPU 渲染 - 提示词驱动，零高级剪辑技能 - 自动初始化会话/令牌，赠送 100 积分，7 天有效期 - 覆盖常见 YouTube 流程：快剪、批量处理、迭代预览/微调 - 内置错误处理、状态推送、导出/下载，输出高质量 MP4
● 无害
安装命令
点击复制官方npx clawhub@latest install ai-video-maker-youtube
镜像加速npx clawhub@latest install ai-video-maker-youtube --registry https://cn.longxiaskill.com镜像同步中