💬 Wechat — WeChat
v1.0.0视频在线 跳过专业剪辑软件的学习曲线。只需描述你的需求——裁剪视频、添加字幕、导出分享到微信——即可获得……
0· 12·0 当前·0 累计
by 下载技能包
最后更新
2026/4/19
安全扫描
OpenClaw
可疑
medium confidence该技能声明的用途（在线微信友好视频编辑）与其运行时指令大体一致，但在声明的配置路径、会话令牌的存储方式与位置，以及自动网络/认证流程方面存在不一致，需谨慎。
评估建议
This skill appears to do what it says (upload your video to a remote service and return an edited MP4), but it will contact https://mega-api-prod.nemovideo.ai, may create and store an anonymous NEMO_TOKEN and session IDs, and will read local install paths to set headers. Before installing or using it: (1) confirm you trust nemovideo.ai and are comfortable uploading videos (they will leave your machine); (2) prefer supplying your own NEMO_TOKEN rather than letting the skill auto-generate/store on...详细分析 ▾
ℹ 用途与能力
Name and description match the actions described in SKILL.md: remote GPU rendering, uploads, exports. Requesting a NEMO_TOKEN is coherent for a remote video-processing backend. However, the SKILL.md frontmatter also lists a config path (~/.config/nemovideo/) while the registry metadata reported no required config paths — this inconsistency should be clarified.
⚠ 指令范围
The instructions instruct the agent to automatically obtain an anonymous token (POST to https://mega-api-prod.nemovideo.ai), create a session, and 'store the returned session_id' for subsequent requests. They also instruct detecting install paths (e.g., ~/.clawhub, ~/.cursor/skills) to set attribution headers. These actions involve network calls, persistent storage of tokens/session IDs, and reading local filesystem paths beyond simple in-memory operation. The SKILL.md does not specify exactly where credentials/session data should be stored or how long they are kept.
✓ 安装机制
No install spec or code files — instruction-only skill — so there is no package download or archive extraction. This minimizes installation-time risk.
⚠ 凭证需求
Only NEMO_TOKEN is declared as required, which is reasonable for a cloud service. But the skill will auto-provision an anonymous token if none is present (network call and token issuance). The SKILL.md frontmatter mentions a config path (~/.config/nemovideo/) that is not listed in the registry metadata; this mismatch is unexplained. The skill also reads install-paths to build X-Skill-Platform attribution headers — accessing these paths may reveal other agent installations. Overall requested environment/credential access is plausible, but the persistence and undeclared config path are disproportionate without further detail.
ℹ 持久化与权限
always is false (normal) and autonomous invocation is allowed (platform default). The real persistence concern is that the skill instructs storing session_id and will create and use anonymous tokens (valid 7 days) — but it does not specify storage location, lifetime, or user visibility. That lack of clarity about credential/session persistence increases privacy risk.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/19
WeChat Video Online 首发——为微信剪辑并导出视频的轻量工具。 - 支持上传 MP4、MOV、AVI、WebM，最大 500MB，在线快速剪辑。 - 用自然语言描述任务（裁剪、加字幕、导出等），30–60 秒获得 AI 剪辑好的可分享 MP4。 - 无需桌面软件，全部处理在安全的远程服务器完成。 - 随时查看剩余额度，批量上传，多会话管理。 - 首次设置与报错均有清晰指引。
● 可疑
安装命令
点击复制官方npx clawhub@latest install wechat-video-online
镜像加速npx clawhub@latest install wechat-video-online --registry https://cn.longxiaskill.com镜像同步中
技能文档
----------|--------|----------| | “export”/“导出”/“download”/“发我视频” | → §3.5 导出 | ✅ | | “credits”/“积分”/“balance”/“余额” | → §3.3 积分 | ✅ | | “status”/“状态”/“show tracks” | → §3.4 状态 | ✅ | | “upload”/“上传”/用户发文件 | → §3.2 上传 | ✅ | | 其他（生成、剪辑、加 BGM…） | → §3.1 SSE | ❌ |
云端渲染流程
每段导出任务在云端 GPU 节点排队，合成视频层并按平台规格压缩（H.264，最高 1080×1920），30-90 秒内返回下载链接。会话 token 携带渲染任务 ID，若提前关闭页面将导致任务孤立。 所有 API 调用需带Authorization: Bearer 及以下三归因头：
X-Skill-Source:wechat-video-onlineX-Skill-Version: 取 YAML 头versionX-Skill-Platform: 按安装路径检测（~/.clawhub/→clawhub，~/.cursor/skills/→cursor，其余unknown）
API 基址：https://mega-api-prod.nemovideo.ai
- 创建会话：POST
/api/tasks/me/with-session/nemo_agent— Body{"task_name":"project","language":""}— 返回task_id,session_id。 - 发送消息（SSE）：POST
/run_sse— Body{"app_name":"nemo_agent","user_id":"me","session_id":"","new_message":{"parts":[{"text":""}]}}，HeaderAccept: text/event-stream，最长 15 分钟。 - 上传：POST
/api/upload-video/nemo_agent/me/— 文件：multipart-F "files=@/path"，或 URL：{"urls":[""],"source_type":"url"} - 积分：GET
/api/credits/balance/simple— 返回available,frozen,total - 会话状态：GET
/api/state/nemo_agent/me//latest— 关键字段：data.state.draft,data.state.video_infos,data.state.generated_media - 导出（免费，不扣积分）：POST
/api/render/proxy/lambda— Body{"id":"render_","sessionId":"","draft":,"output":{"format":"mp4","quality":"high"}}。轮询 GET/api/render/proxy/lambda/每 30s 一次，直至status=completed，下载链接在output.url。