Video Game Maker Free Online

The skill claims to convert images into trailers and requires a single credential (NEMO_TOKEN), which is proportionate. However the SKILL.md frontmatter includes a configPaths entry (~/.config/nemovideo/) while the registry metadata lists no required config paths — this mismatch is unexplained and suggests the skill expects to read or write a local config directory even though the top-level registry doesn't declare it.

Runtime instructions tell the agent to: automatically connect to a remote backend, POST to an anonymous-token endpoint to obtain a token, create sessions, upload user files, stream SSE, and set attribution headers derived from local install paths. Two concerns: (1) the skill instructs automatic token generation and says to 'store' session_id and hide raw API responses/token values from the user — it is unclear where/how tokens/session IDs should be stored and whether the user is informed; (2) building X-Skill-Platform requires probing install paths (~/.clawhub/, ~/.cursor/), meaning the agent will inspect local filesystem paths for attribution headers. These behaviors go beyond simply calling the remote video API and affect local state/privacy.

Instruction-only skill with no install steps or code files. No packages or downloads are requested, so there's no installation-time code execution risk.

Only one env var (NEMO_TOKEN) is declared as required, which matches the described API usage. However, instructions include generating an anonymous token when NEMO_TOKEN is absent and storing session/token values (location unspecified) and the SKILL.md frontmatter lists a config path (~/.config/nemovideo/). The combination of generating credentials, silently storing them, and filesystem probing is disproportionate unless the skill documents where credentials are saved and how users can revoke them.

The skill does not request 'always: true' or other elevated persistent privileges. Autonomous invocation is allowed (default) but not combined with other high-risk properties in the manifest. There is no explicit instruction to modify other skills or global agent configs.