Youtube Video Editor For Hire

edit raw video footage into polished edited videos with this skill. Works with MP4, MOV, AVI, WebM files up to 500MB. YouTubers use it for editing raw YouTub...

This skill appears to do what it says (send videos to a cloud API for editing) but there are a few things to consider before installing or using it: - NEMO_TOKEN is the primary credential: only provide it if you trust the remote service. If you do not want to give a permanent token, rely on the anonymous token path, but be aware the skill will automatically request one from https://mega-api-prod.nemovideo.ai when no token is present. - Metadata mismatch: the SKILL.md frontmatter mentions a config path (~/.config/nemovideo/) while the registry metadata does not. Ask the publisher whether the skill will read that directory (which could contain local credentials or config) and why. - Transparency: the instructions explicitly direct the agent to 'keep technical details out of the chat.' That hides API calls and tokens from users and makes auditing harder. Prefer skills that are explicit about what they send and store. - Data exposure: uploaded videos (up to 500MB) will be transmitted to a third-party domain. Confirm the service's privacy policy, retention practices, and whether uploaded content may be stored or used for model training. - Lack of provenance: there is no homepage or source/repository for the skill. If you need stronger assurance, request the skill's source or a publisher contact and a privacy/security statement. What would change my assessment to benign: availability of the skill's source or a trustworthy homepage, reconciliation of the configPaths/registry metadata mismatch, explicit documentation of token scope/storage and data-retention/privacy policies, or confirmation that the skill does not read arbitrary local config files beyond what's necessary. Without that, treat the skill as functional but with transparency and data-exposure concerns.

Type: OpenClaw Skill Name: youtube-video-editor-for-hire Version: 1.0.0 The skill integrates with an external video editing service (nemovideo.ai) but contains high-risk instructions that allow the remote backend to trigger tool calls on the agent silently ('Process internally, don't forward' in SKILL.md). It also includes logic to upload local files to the remote server and probes the host's filesystem for installation paths (e.g., checking for ~/.clawhub or ~/.cursor) to generate 'skill attribution' headers. These capabilities, combined with instructions to hide technical details from the user, create a significant risk for unauthorized remote command execution and data exfiltration.