by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's instructions line up with a cloud video-conversion service, but there are small metadata/instruction mismatches and privacy/network implications you should understand before installing.
评估建议
This skill appears to do what it says (upload your video and get back a converted file) but you should be cautious before installing/use: 1) Privacy: the skill uploads your videos to mega-api-prod.nemovideo.ai — confirm the service's privacy/retention policy before sending sensitive content. 2) Token behavior: the skill will use NEMO_TOKEN if present, or automatically request an anonymous token and use that — decide whether you want to place a token in your environment or let it create an anonym...详细分析 ▾
ℹ 用途与能力
The name/description (cloud video conversion) matches the runtime instructions (upload files, create session, render on remote GPUs). Requesting a NEMO_TOKEN is coherent. However, the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) that the registry metadata did not — this mismatch is unexplained and worth clarifying.
ℹ 指令范围
SKILL.md instructs the agent to upload user video files and metadata to mega-api-prod.nemovideo.ai, create sessions, stream SSE, and poll for render results — all expected for the stated purpose. The skill will obtain or use a bearer token (NEMO_TOKEN) and may call an anonymous-token endpoint if none is present. It does not instruct reading unrelated local files or broad environment scanning, but it does require uploading potentially sensitive video content to a third-party service (privacy/retention risk).
✓ 安装机制
Instruction-only skill with no install spec and no code files, so nothing is written to disk by an installer. This is the lowest install risk.
ℹ 凭证需求
Only one environment variable (NEMO_TOKEN) is declared as required, which is proportional for an API-based conversion service. Two minor issues: (1) SKILL.md will auto-request an anonymous token if NEMO_TOKEN is not set (so the skill doesn't strictly need a pre-provided token), and (2) SKILL.md frontmatter references a config path that the registry metadata does not list. Both are inconsistencies you should confirm with the author. Consider not putting sensitive global secrets in NEMO_TOKEN unless you trust the service.
✓ 持久化与权限
always:false (default) and no instructions to modify other skills or system-wide settings. The agent can invoke the skill autonomously (normal default) but the skill does not request elevated or persistent local privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/20
- Initial release of "Free Video To — Convert and Export Video Files" - Supports uploading MP4, MOV, AVI, and WebM files up to 500MB - Automatic cloud-based video conversion, editing, and export to 1080p MP4 - Simple, prompt-based interface for quick edits, captions, and music - Tracks session state, credits balance, and export status via API - Instant onboarding with token management and anonymous user support
● 无害
安装命令
点击复制官方npx clawhub@latest install free-video-to
镜像加速npx clawhub@latest install free-video-to --registry https://cn.longxiaskill.com镜像同步中