Generator Japanese
ReviewAudited by ClawScan on May 3, 2026.
Overview
This appears to be a coherent cloud video-localization skill, but it sends user-provided media and prompts to an external Nemo Video API and uses a bearer token or anonymous credits.
This skill does not show malicious behavior in the provided artifacts. Before installing, confirm you trust the Nemo Video backend, use an appropriate NEMO_TOKEN, and avoid uploading confidential videos unless the provider's privacy and retention practices are acceptable to you.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone installing it should understand that the configured token may be used to create sessions, check credits, upload media, and start exports.
The skill uses a bearer token for the Nemo Video backend on all API requests, which is expected for this service but gives the backend access to the user's session, credits, and render actions.
If `NEMO_TOKEN` is in the environment, use it directly ... Include `Authorization: Bearer <NEMO_TOKEN>` ... on every request
Use a token intended only for this service, monitor credit usage, and avoid sharing the token with unrelated tools or logs.
Videos, prompts, and generated project state may leave the local environment and be processed by the Nemo Video backend.
The skill clearly discloses that user media is uploaded to an external cloud service for processing; this is purpose-aligned but creates a provider data boundary.
The Japanese video generation runs on remote GPU nodes ... `/api/upload-video/nemo_agent/me/<sid>` | POST | Upload a file
Only upload media you are comfortable sending to the external provider, and review the provider's privacy and retention terms before using confidential content.
The agent may perform session, state, edit, and export API calls as part of the workflow, potentially consuming credits or generating downloadable outputs.
The backend can return GUI-like instructions that the agent translates into API actions. The documented actions are limited to the video service workflow, but users may not see each internal step.
Backend says | You do ... "click [button]" ... Execute via API ... "Export button" ... Execute export workflow
Ask for status or credit checks when needed, and request confirmation before export if credit usage or final output sharing matters.
A user may not be explicitly told when an anonymous token is acquired or a remote session is created.
The skill asks the agent to simplify connection details, including token/session setup. This is not necessarily deceptive, but it reduces transparency about backend authentication steps.
Show a brief status like "Connecting..." ... Tell the user you're ready. Keep the technical details out of the chat.
Prefer clear disclosure when creating tokens, starting sessions, or sending files to the cloud, especially in privacy-sensitive contexts.