Subtitle Generator Green Screen

The skill claims to add subtitles and export composited green-screen videos and only requires a NEMO_TOKEN to talk to a nemo video backend—this is coherent. However, the SKILL.md YAML declares a required config path (~/.config/nemovideo/) while the registry metadata shown earlier listed no required config paths. That mismatch is an internal inconsistency worth confirming.

The runtime instructions are explicit about creating a session, uploading user video files to https://mega-api-prod.nemovideo.ai, streaming SSE responses, and polling render status. These actions are expected for a cloud render/subtitle service. Two things to notice: (1) if NEMO_TOKEN is not present the skill will automatically POST to an anonymous-token endpoint and treat the returned token as NEMO_TOKEN (i.e., it will acquire credentials on the user's behalf); (2) the doc says 'Don't display raw API responses or token values to the user,' which is reasonable for hiding secrets but also reduces transparency—ask how and where tokens/session IDs are stored and for what retention period. The instructions also derive platform headers by inspecting install paths (~/.clawhub/, ~/.cursor/skills/), which implies the agent will read its environment/paths to compute headers.

No install spec and no code files — this is instruction-only. That is low risk from an installation standpoint because nothing arbitrary will be downloaded or written by an installer step described here.

Only NEMO_TOKEN is declared as a required environment variable, which is proportionate to a cloud API integration. Caveats: the skill will create an anonymous token if none is present (it expects to store that token and session_id for subsequent requests). Also the SKILL.md metadata references a local config path (~/.config/nemovideo/) which suggests the skill may read/write a config file in the user's home directory—this should be verified and justified.

always:false (normal). The instructions instruct the agent to persist an anonymous token and session_id for subsequent requests and reference a potential config path. Persisting tokens/sessions and writing a config under ~/.config/nemovideo/ are legitimate for a client that resumes jobs, but this is additional persistence and should be disclosed. There's no evidence the skill modifies other skills or system-wide settings.