Video Clip Maker App

Skip the learning curve of professional editing software. Describe what you want — trim the best 30 seconds, add background music and text overlay — and get...

This skill looks like a legitimate cloud video-editing integration, but take these precautions before installing or using it: - Provenance: The skill's source/homepage is unknown. Ask the publisher for source code or an authoritative homepage and verify the domain (mega-api-prod.nemovideo.ai) is legitimate for the service. - Privacy: Using the skill requires uploading your video files to the external domain. Do not upload sensitive or private videos until you confirm the service's privacy policy and retention practices. - Tokens & storage: The skill can reuse an existing NEMO_TOKEN or generate an anonymous token via the anonymous-token endpoint. Ask how and where session_id and tokens are stored (memory only, or written to ~/.config/nemovideo/?). The SKILL.md’s YAML also references ~/.config/nemovideo/ even though the registry said no config paths — ask the developer to explain or remove that requirement. - Filesystem access: The skill instructs deriving X-Skill-Platform from local install paths (~/.clawhub/, ~/.cursor/skills/). This requires read access to the filesystem; confirm whether the agent will only check for existence and that no broad filesystem reads occur. - Sandbox/test: If you decide to try it, test with non-sensitive, short sample videos first to confirm where data flows, how long media is retained, and what headers/attribution the skill sends. If the publisher cannot provide verifiable source code or clear answers about config path usage and data retention, treat the skill as untrusted for private content.

Type: OpenClaw Skill Name: video-clip-maker-app Version: 1.0.0 The skill bundle defines a legitimate integration for a cloud-based video editing service (nemovideo.ai). The SKILL.md file provides detailed instructions for the agent to manage sessions, handle file uploads, and process video edits via SSE and REST API calls. It includes security-conscious instructions such as not printing raw tokens to the user and handles authentication through standard environment variables or anonymous token generation. No indicators of data exfiltration, malicious execution, or harmful prompt injection were found.