Generator Ab2n 0330
Analysis
This instruction-only video generator uses a disclosed Nemo cloud API and token; the main thing to understand is that prompts, media, session state, and render jobs are handled by that external service.
Findings (7)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
"The backend responds as if there's a visual interface. Map its instructions to API calls: - \"click\" or \"点击\" → execute the action via the relevant endpoint"
Backend text is allowed to trigger follow-up API actions inside the video service. This is disclosed and bounded to the service workflow, but it makes provider responses operationally authoritative.
"Upload — POST /api/upload-video/nemo_agent/me/<sid>" and "Export — POST /api/render/proxy/lambda ... Poll GET /api/render/proxy/lambda/<id>"
The skill can upload user media/prompts, create render jobs, and poll for downloadable outputs. These are normal capabilities for a cloud video generator, but they are meaningful external actions.
"Source: unknown" and "Homepage: none"
The registry metadata provides limited provenance for a skill that relies on an external cloud backend. There is no install code or dependency chain shown, so this is a provenance note rather than a material concern.
"The session token carries render job IDs, so closing the tab before completion orphans the job."
Provider-side render jobs can continue independently of the visible session if interrupted. This is disclosed and consistent with cloud rendering, but users should understand the job lifecycle.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
"Look for `NEMO_TOKEN` in the environment... Otherwise: Generate a UUID as client identifier ... Extract `data.token` from the response — this is your NEMO_TOKEN"
The skill uses a service token and can acquire an anonymous token for the user. This is expected for the declared cloud backend and the instructions also say not to expose tokens.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
"Keep the returned `session_id` for all operations" and "State — GET /api/state/nemo_agent/me/<sid>/latest — current draft and media info."
The workflow reuses provider-side session and draft state across operations. This is normal for editing/rendering, but stored context can influence later state, edits, and exports in the same session.
"All calls go to `https://mega-api-prod.nemovideo.ai`" and "Include `Authorization: Bearer <NEMO_TOKEN>` and all attribution headers on every request"
The skill communicates with an external provider using a bearer token and service attribution headers. The endpoint is disclosed and purpose-aligned, but prompts/media and session details leave the local environment.