🎬 Text To Video Editor — 一键文生视频
v1.0.0用一句话描述即可生成带画面与背景音乐的30秒短视频，无需学习专业剪辑软件，自动匹配素材、节奏与字幕，极速完成创意视频。
0· 60·0 当前·0 累计
by 下载技能包
最后更新
2026/4/13
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to be what it says (a cloud text→video editor) and only asks for the service token it needs, but there are a few unclear points you should consider before installing or enabling it: 1) Source is unknown — verify the provider (nemovideo.ai) and whether you trust it with uploaded script files (uploads can include sensitive text and media). 2) The skill will either use NEMO_TOKEN from your environment or automatically request an anonymous token on your behalf; decide whether you ...详细分析 ▾
ℹ 用途与能力
The name and description (text→video rendering) align with the only declared credential (NEMO_TOKEN). However, the SKILL.md metadata includes a required config path (~/.config/nemovideo/) while the registry metadata reported no required config paths — an inconsistency. Also the instructions expect to emit an X-Skill-Platform header derived from an install path (~/.clawhub/, ~/.cursor/skills/) even though this skill has no install spec; that implies the skill may read filesystem paths not declared in the registry metadata.
ℹ 指令范围
Runtime instructions are mostly limited to interacting with the remote nemovideo.ai API (auth, session creation, SSE, upload, export). This is expected for a cloud rendering skill. Concerning points: (1) the skill tells the agent to automatically POST for an anonymous token if NEMO_TOKEN is unset (it also instructs to not show raw token values to the user), giving the agent discretion to obtain and manage credentials; (2) it says to "store the returned session_id for all subsequent requests" but doesn't specify where or how (memory vs disk vs agent config); (3) header construction requires detecting an install path which may cause the agent to check filesystem locations. None of these are proof of malice but they are ambiguous and expand what the agent may read/store.
✓ 安装机制
No install spec and no code files — instruction-only. This is the lowest-risk install mechanism (nothing is downloaded or extracted).
ℹ 凭证需求
Only NEMO_TOKEN is required, which is proportionate to a third-party video rendering API. Still, the skill's ability to mint anonymous tokens on the user's behalf and the unclear guidance about session token persistence increase the risk of credential leakage or unintended long-lived tokens. The SKILL.md metadata referencing a config path (~/.config/nemovideo/) that could contain credentials is also inconsistent with the registry manifest and should be clarified.
✓ 持久化与权限
always:false and no install steps — the skill does not request permanent, forced inclusion. It does instruct keeping a session_id for the life of the session and notes that closing a tab may orphan jobs, but it does not request elevated system privileges or modifications to other skills' configs.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/13
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install text-to-video-editor
镜像加速npx clawhub@latest install text-to-video-editor --registry https://cn.longxiaskill.com