Video Maker Free Download

Name/description claim cloud video creation and the skill asks for a NEMO_TOKEN and describes upload/render API calls — that aligns with the stated purpose. However the frontmatter metadata includes a config path (~/.config/nemovideo/) while the registry metadata earlier listed no required configPaths; there's no homepage or source to verify the backend. The mismatch and missing provenance reduce trustworthiness.

SKILL.md instructs the agent to upload user media and to create sessions and render jobs on https://mega-api-prod.nemovideo.ai — expected for the stated purpose. Concerns: (1) it tells the agent to derive and send X-Skill-Platform by inspecting the agent's install path (e.g., ~/.clawhub/, ~/.cursor/skills/), which requires probing local filesystem/paths and may leak environment details unnecessarily; (2) the doc contains a truncated mapping that appears to map GUI actions to shell commands (e.g., 'preview in timeline → sh …'), implying the agent may run shell commands — this is vague and grants broad discretion; (3) the fallback anonymous-token flow posts a generated client UUID to the API to obtain a token (fine in principle) but that means users who do not provide a token still have media and metadata sent to an external, unverified service. The instructions otherwise stay within the service domain (no unrelated system credential reads were found), but the path-detection and vague shell mapping are scope creep.

Instruction-only skill with no install spec or code files — nothing is written to disk by the skill itself. This is lowest-risk from an install perspective.

Only one credential is declared: NEMO_TOKEN (primaryEnv). That is appropriate for a cloud API client. The SKILL.md also describes obtaining an anonymous token if NEMO_TOKEN isn't present. The frontmatter, however, references a config path (~/.config/nemovideo/) that could give the skill access to files not declared in registry metadata — an inconsistency worth clarifying. Do not provide unrelated secrets (AWS keys, personal API tokens).

always is false and the skill has no install step and does not request to modify other skills or system-wide settings. Autonomous invocation is allowed (default) but not combined with elevated privileges or persistence.