📦 Ai — AI
v1.0.0视频脚本撰写器 无需拖动任何滑块，即可获得可直接发布的现成脚本。上传你的主题或大纲（MP4、MOV、TXT、DOCX，最大 200MB），只需说……
0· 15·0 当前·0 累计
by @imo14reifey下载技能包
最后更新
2026/4/19
安全扫描
OpenClaw
可疑
medium confidence该技能似乎实现了与其描述相符的云视频/脚本生成流程，但其运行指令中包含来自外部域的自动令牌发放、令牌的隐藏处理以及声明的配置路径——这些行为出乎意料，在安装前值得仔细审查。
评估建议
This skill likely does what it says (cloud-based video script + render), but pay attention to a few things before installing:
- Domain & legitimacy: the backend host (mega-api-prod.nemovideo.ai) is not a widely-known vendor in the manifest. Verify the service and privacy policy before sending content.
- Tokens & transparency: the skill will try to mint an anonymous NEMO_TOKEN if you don't provide one and instructs the agent not to show raw API responses or token values. Prefer supplying a tok...详细分析 ▾
ℹ 用途与能力
The skill's name and description (cloud AI video/script generation) match the endpoints and Authorization token usage in SKILL.md. Requesting a single service token (NEMO_TOKEN) is proportional to the stated purpose. However, the manifest also declares a config path (~/.config/nemovideo/) which is not referenced in the runtime steps beyond 'store session_id' — it's plausible but not clearly justified.
⚠ 指令范围
The SKILL.md instructs the agent to POST to https://mega-api-prod.nemovideo.ai to obtain an anonymous token (if NEMO_TOKEN not present), create sessions, upload user files (video/audio/docs up to 200MB), stream SSE events, poll render status, and store session IDs. It also explicitly instructs to 'keep setup communication brief' and 'Don't display raw API responses or token values to the user' — instructing concealment of tokens/API responses increases risk because it reduces transparency about what credentials or responses are being handled. Uploading user files to a remote service is expected for this skill but is a privacy-sensitive operation and should be clearly disclosed to users.
✓ 安装机制
This is an instruction-only skill with no install spec and no code files — lowest install risk (nothing is written to disk by an installer). All behavior comes from runtime instructions, not an installed binary or downloaded archive.
⚠ 凭证需求
Only one env var is required (NEMO_TOKEN) which is consistent with an API-backed service. However: (1) the skill's instructions include an automatic flow to mint an anonymous token and then use it as NEMO_TOKEN, which means the skill can generate credentials on behalf of the user; (2) the manifest declares a config path (~/.config/nemovideo/) which suggests it may read/write files there (not fully explained); and (3) the instructions to not display tokens diminish transparency. These behaviors are plausible but not fully justified by the SKILL.md and increase the risk profile.
ℹ 持久化与权限
The skill is not marked always:true and does not request elevated system privileges. It instructs the agent to store a session_id and potentially a token for subsequent requests (normal for a remote service). The presence of a declared config path implies potential on-disk persistence of token/session data — acceptable for session caching but should be made explicit so users can inspect and control where credentials are stored.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/19
AI Video Script Writer — 初始版本 - 上传主题、大纲或媒体（MP4、MOV、TXT、DOCX，最大 200MB）即可瞬间生成结构化视频脚本。 - 一键配置，自动连接后端，赠送 7 天免费 token 与 100 积分，无需文案经验。 - 为 YouTuber、营销人员及创作者提供高速脚本写作，支持云端编辑与 1080p MP4 导出。 - 集成命令处理：用自然语言即可生成脚本、上传文件、导出视频、查询积分或查看状态。 - 强大的后端流水线处理文件、脚本与导出；所有请求须带 attribution header 才能成功。 - 清晰的会话与错误处理，附详细指南，助你最快上手并获得最佳效果。
● 无害
安装命令
点击复制官方npx clawhub@latest install ai-video-script-writer
镜像加速npx clawhub@latest install ai-video-script-writer --registry https://cn.longxiaskill.com