by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's declared purpose (cloud video editing) aligns with the single credential it requests (NEMO_TOKEN) and its runtime API calls, but there are inconsistencies in metadata (a referenced config path in the skill frontmatter that isn't declared in the registry) and the skill will upload user video files to an external API operated at mega-api-prod.nemovideo.ai — review before installing from an unknown source.
评估建议
This skill appears to be a front-end for a cloud video-editing API and will upload any files you provide to an external host (mega-api-prod.nemovideo.ai). Before installing: (1) Confirm you trust that external service — your videos and audio will leave your machine. (2) Ask the author to explain the discrepancy between the registry (no config paths) and the SKILL.md frontmatter (mentions ~/.config/nemovideo/). If that config path is actually accessed, ask what is read and why. (3) Prefer using t...详细分析 ▾
ℹ 用途与能力
The skill claims to perform cloud video editing and requires a single bearer token (NEMO_TOKEN) and calls media-processing endpoints on mega-api-prod.nemovideo.ai — that is coherent. However, the SKILL.md frontmatter includes a required config path (~/.config/nemovideo/) whereas the registry metadata reported no config paths; this mismatch should be clarified.
ℹ 指令范围
The runtime instructions are explicit about starting sessions, uploading files, streaming SSE, and polling render endpoints — all within the advertised purpose. The skill also instructs the agent to (a) read its own YAML frontmatter for attribution headers and (b) detect install path (~/.clawhub/, ~/.cursor/skills/) to set X-Skill-Platform — both require reading local filesystem paths. These filesystem reads are plausible for attribution but expand the scope beyond pure network calls and should be documented/justified by the author.
✓ 安装机制
No install spec and no code files are present; this is an instruction-only skill. That is low-risk from an install-execution perspective because nothing is downloaded or executed locally by the installer.
ℹ 凭证需求
Only one credential is declared (NEMO_TOKEN) and that maps to the external API used by the skill — proportionate. The frontmatter's mention of a config path (~/.config/nemovideo/) is unexpected relative to the registry data and would grant the skill access to local service config if honored; that is disproportionate unless the skill genuinely needs that local config. Also note the skill will upload user video/audio files to a third-party service, which is expected for the function but is a privacy consideration.
✓ 持久化与权限
The skill does not request always:true and does not declare modifications to other skills or system-wide settings. It can be invoked autonomously (default) which is normal; consider this when granting an unknown skill permission to run.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/17
Initial release of Video Guide — Create and Export Instructional Videos. - Upload raw video footage (MP4, MOV, AVI, WebM, up to 500MB) for guided editing and export. - Add step-by-step captions, chapter markers, and other enhancements via natural language prompts. - Exports finished 1080p MP4 videos, typically within 1–2 minutes. - Built-in credit management and session handling with automatic anonymous token generation. - Designed for educators and content creators to create structured instructional videos quickly without complex editing tools.
● 无害
安装命令
点击复制官方npx clawhub@latest install video-guide
镜像加速npx clawhub@latest install video-guide --registry https://cn.longxiaskill.com镜像同步中