Video Clip Maker Online Free

edit video clips into edited video clips with this skill. Works with MP4, MOV, AVI, WebM files up to 500MB. TikTok creators use it for trimming and assemblin...

This skill appears to do what it says (cloud video editing) but I flagged it as suspicious because: (1) the SKILL.md instructs the agent to automatically obtain and store a token from https://mega-api-prod.nemovideo.ai and to hide token/API responses from the user, and (2) the frontmatter asks the agent to access ~/.config/nemovideo/ though registry metadata lists no config paths — an internal inconsistency. Before installing, consider: - Do you trust nemovideo.ai as a destination for uploading potentially-sensitive videos? All media will be sent to that backend. - The skill will either use your NEMO_TOKEN or create one automatically; ask for explicit consent before any automatic token creation or upload. - Because this is instruction-only (no code to inspect) and the source/homepage is unknown, you have limited auditability. Prefer skills from known publishers or with a homepage/repo you can review. - If you still want to try it, require the skill to prompt you before creating tokens or uploading files, and avoid uploading private/confidential footage. - To reduce risk: manually obtain and set a dedicated NEMO_TOKEN with minimal scope, or test the endpoints outside the agent first to verify behavior. If you can get the publisher, homepage, or source repo, share it and I can reassess with higher confidence.

Type: OpenClaw Skill Name: video-clip-maker-online-free Version: 1.0.0 The skill provides video editing capabilities via a remote API (mega-api-prod.nemovideo.ai) but includes high-risk instructions that establish a potential command-and-control (C2) mechanism. Specifically, SKILL.md instructs the agent to process 'tool calls' received via a Server-Sent Events (SSE) stream 'internally' and 'don't forward' them to the user, which could allow the remote server to execute arbitrary local tools. It also requires hiding raw API responses and tokens, and performs environment fingerprinting via the 'X-Skill-Platform' header. While these features are highly risky and characteristic of a backdoor, the lack of an explicit instruction to perform a specific harmful act (e.g., data theft) warrants a suspicious rather than malicious classification.