by 安全扫描
OpenClaw
可疑
medium confidenceThe skill largely matches a remote video-processing integration, but there are inconsistencies and a few underspecified behaviors (automatic token creation, session persistence, and a declared config path) that you should understand before installing.
评估建议
This skill appears to be a wrapper around a third-party cloud video rendering API and is generally coherent, but before installing consider: 1) The skill will create or use a NEMO_TOKEN (it can auto-request an anonymous token) and will store a session_id — ask where those are stored and for how long; if stored under ~/.config/nemovideo/ your registry metadata should declare that. 2) Uploaded video content is sent to mega-api-prod.nemovideo.ai — confirm the service's privacy, retention, and secur...详细分析 ▾
ℹ 用途与能力
Name, description, and declared primary credential (NEMO_TOKEN) align with a cloud video-rendering service. However, the SKILL.md frontmatter references a config path (~/.config/nemovideo/) that is not listed in the registry metadata, which is an internal inconsistency—it suggests the skill may store data on disk or expect on-disk config even though the package metadata did not declare it.
ℹ 指令范围
Instructions are narrowly scoped to creating a session, uploading media, streaming SSE edits, polling render status, and downloading outputs. They also direct the agent to auto-obtain an anonymous token when none is present and to "store the returned session_id for all subsequent requests." The skill explicitly instructs not to show raw API responses or token values. The main concern is underspecification: it does not say where session_id or tokens are stored (memory vs. disk), nor how long they persist, and it asks the agent to auto-connect on first use.
✓ 安装机制
Instruction-only skill with no install spec or code files — lowest install risk. All network activity is via documented API endpoints; no archives or external binaries are downloaded.
ℹ 凭证需求
Only one declared env var (NEMO_TOKEN) which is appropriate for an API-backed video service. Minor issues: the SKILL.md frontmatter also lists a config path (~/.config/nemovideo/) and a requirement to auto-detect an install path to set X-Skill-Platform; these imply the skill may read filesystem/agent install path information not reflected in the registry's declared requirements.
ℹ 持久化与权限
always:false (normal). The skill instructs the agent to 'store' session_id and to attempt automatic token acquisition; it is unclear whether these credentials/session IDs are persisted to disk (e.g., under ~/.config/nemovideo/) or only held in-memory. That uncertainty raises a modest persistence/privacy concern but not an elevated privilege or cross-skill modification claim.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/19
Initial release — produce and export AI-edited videos from raw footage, no manual editing required. - Upload raw video files (MP4, MOV, AVI, WebM, up to 500MB) and describe the edit you want. - Automated cloud-based processing: edits, adds music, exports polished 1080p MP4s. - Easy setup with free credits—no payment or software needed. - Handles pause removal, background music, simple overlays, and exports in ~1–2 minutes. - Supports batch uploads, iterative editing, and common video formats. - Reliable session and credit management with clear status, error, and progress messages.
● 无害
安装命令
点击复制官方npx clawhub@latest install video-producer-free
镜像加速npx clawhub@latest install video-producer-free --registry https://cn.longxiaskill.com