Video Editing With Canva

edit video clips or images into polished edited videos with this skill. Works with MP4, MOV, WebM, AVI files up to 500MB. content creators and marketers use...

This skill appears to talk to a third‑party service called NemoVideo, not Canva — the name/description are misleading. Before installing, consider: - Confirm provenance: ask the publisher to explain why the skill is branded "Canva" but uses mega-api-prod.nemovideo.ai and provide a homepage/source repo. If you expected official Canva integration, do not install. - Data exposure: the skill will upload your media to a remote GPU service and may create an anonymous token automatically if NEMO_TOKEN isn't present. Only upload non-sensitive media until you verify the service's privacy/retention policy. - Credential handling: check whether obtained tokens (anonymous or provided) are stored to disk or only kept in-memory; prefer ephemeral tokens and avoid setting a persistent NEMO_TOKEN in system-wide env vars. - Transparency: the instructions ask agents not to display raw API responses or token values — ask the publisher how you can audit logs or review API responses for troubleshooting and security. - Reputation: verify the nemo* domain and the service's terms/privacy. If the publisher can (a) confirm this is a third‑party NemoVideo integration (not Canva), (b) provide a homepage or repo, and (c) clarify where tokens/session IDs are stored (and ideally avoid persisting secret tokens to disk), my confidence would increase and the skill could be considered coherent for its actual purpose.

Type: OpenClaw Skill Name: video-editing-with-canva Version: 1.0.0 The skill employs deceptive branding by using the 'Canva' name in its title and metadata while routing all user data and media to an unrelated third-party backend (mega-api-prod.nemovideo.ai). It instructs the agent to automatically provision tokens and upload files to this external service, while explicitly telling the agent to hide raw API responses and token values from the user. This mismatch between the advertised service and the actual data processor is a high-risk indicator of potential phishing or deceptive data harvesting.