by 安全扫描
OpenClaw
安全
high confidenceThe skill appears to do what it claims — it uploads user video files to a cloud video-editing backend and uses a single service token — with one small metadata inconsistency to clarify before install.
评估建议
This skill appears coherent for cloud video editing, but consider these points before installing:
- Privacy: your videos will be uploaded to mega-api-prod.nemovideo.ai for processing. Do not send sensitive or confidential footage unless you trust their privacy policy.
- Token handling: the skill expects a NEMO_TOKEN. If none is provided it will call the service to obtain an anonymous, short-lived token (100 free credits, 7-day expiry). Ask the developer whether that token is only held in-memory...详细分析 ▾
ℹ 用途与能力
The name/description (cloud-based AI video editing) matches the runtime instructions (upload files, create sessions, render/export via nemovideo.ai endpoints). One inconsistency: the SKILL.md frontmatter declares a config path (~/.config/nemovideo/) while the registry metadata reported no required config paths. That mismatch should be clarified (will the skill read/write files under that path?).
✓ 指令范围
Instructions are focused on the stated task: check/obtain a NEMO_TOKEN, create a session, upload videos, stream edits via SSE, and start renders. It explicitly instructs not to expose tokens/raw API output. The skill will upload user-provided media to an external service (mega-api-prod.nemovideo.ai) — expected for the purpose but a privacy consideration for sensitive content.
✓ 安装机制
There is no install spec or code to download; the skill is instruction-only, so it does not write code to disk or execute an installer. This is the lowest-risk install model.
ℹ 凭证需求
The only declared credential is NEMO_TOKEN, which is proportional to a cloud editing service. The instructions also include an anonymous-token flow (POST to /api/auth/anonymous-token) to obtain a short-lived token if none is present. Combined with the frontmatter config path, this suggests the skill may persist tokens/config locally (unclear). Confirm whether it will write tokens to disk and where.
✓ 持久化与权限
always:false and model invocation are normal. The skill does not request elevated or system-wide privileges and does not modify other skills' config. It will maintain session_id for ongoing requests, which is appropriate for the workflow.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/19
Video Edit Online 1.0.0 — Initial Release - Edit and export videos online from raw footage up to 500MB; supports MP4, MOV, AVI, WebM, and more. - Cloud-powered AI video editing: trim pauses, add transitions, overlays, and export as 1080p MP4—processing usually takes 1–2 minutes. - Automatic session and token setup with free starter credits; all work occurs securely on cloud GPUs. - Simple upload, edit, and export workflow; intuitive command mapping for common video editing actions. - Transparent credit, error, and status tracking; clear session summaries and timeline overviews provided.
● 无害
安装命令
点击复制官方npx clawhub@latest install video-edit-online
镜像加速npx clawhub@latest install video-edit-online --registry https://cn.longxiaskill.com镜像同步中