The skill's declared purpose (cloud video trimming) matches the API calls it describes and the single required credential (NEMO_TOKEN), but there are small inconsistencies and privacy/telemetry concerns you should understand before installing or uploading sensitive videos.
评估建议
This skill appears to do what it says (upload your footage to a remote rendering service and return trimmed clips) and only asks for one credential (NEMO_TOKEN). Before installing or using it:
- Remember you will be uploading video to an unknown third-party host (mega-api-prod.nemovideo.ai). Do not upload sensitive or confidential footage until you confirm the provider's privacy policy and security practices.
- Prefer supplying your own NEMO_TOKEN (if you have one) rather than letting the ski...
详细分析 ▾
✓用途与能力
The name and description (product video cutting) align with the runtime instructions: creating sessions, uploading video files, streaming edits, and requesting renders from https://mega-api-prod.nemovideo.ai. Requesting a single token (NEMO_TOKEN) is proportionate for a hosted service API.
ℹ指令范围
Instructions stay within the stated purpose (session creation, upload, SSE, render/polling). However, the SKILL.md instructs generating anonymous tokens and saving them as NEMO_TOKEN, and it describes deriving headers that include an installation path detector (e.g., checking ~/.clawhub/ or ~/.cursor/skills/), which implies the agent may inspect local paths. The SKILL.md does not explicitly instruct reading other system secrets, but the install-path detection and a metadata configPaths entry (~/.config/nemovideo/) could encourage reading local config — ask the author to clarify what local files, if any, the agent will access.
✓安装机制
No install spec and no code files (instruction-only) — lowest install risk. The skill simply describes remote API usage; nothing is downloaded or written by an installer in the manifest.
ℹ凭证需求
Only NEMO_TOKEN is required, which is appropriate for a hosted video-processing API. Still, the skill may create and store an anonymous token if none exists. Treat NEMO_TOKEN as a sensitive credential — the skill will use it for all API calls. The metadata references a config path (~/.config/nemovideo/) even though the registry reported no required config paths; this mismatch should be clarified.
✓持久化与权限
The skill is not set to always:true and does not request system-wide persistence. It does instruct saving a session_id returned by the API (expected for interactive sessions). Autonomous invocation is allowed by default but not combined with other high-risk requests.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/19
Product Video Cutter Online — Initial Release
- Instantly cut and export product video clips via a streamlined cloud workflow.
- Upload video footage (MP4, MOV, AVI, WebM, up to 500MB) and use natural language to describe edits (e.g., "cut out the intro and trim to 30 seconds for Instagram").
- Automatic session and token management, including anonymous access with 100 free credits.
- Exports high-quality 1080p MP4 clips processed on remote GPU nodes, ready to download in under a minute.
- Supports workflows for quick edits, batch processing, and iterative improvements; shows download, credits status, and current timeline summary.
- Handles errors gracefully with clear messaging for uploads, exports, credits, and session state.
by