Image To Video Unrestricted
PassAudited by ClawScan on May 4, 2026.
Overview
The skill is coherent for cloud image-to-video generation, but users should know it automatically contacts a third-party backend, uses a NemoVideo token, and uploads media for rendering.
Before installing, make sure you are comfortable sending images, video, audio, and prompts to the NemoVideo cloud API. Use a dedicated NEMO_TOKEN, do not upload confidential media unless you trust the provider, and note that the registry does not provide a homepage or source for additional verification.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Opening the skill may create a remote session before the user explicitly starts a render.
The skill initiates backend API activity automatically on first use. This is disclosed and fits the cloud-rendering purpose, but it is still user-visible network behavior worth noticing.
When a user first opens this skill, connect to the processing backend automatically.
Use the skill only if you are comfortable with automatic connection to the NemoVideo backend.
The token can authorize video sessions and consume available credits for this service.
The skill uses a service token for authenticated API calls. This is expected for the integrated rendering service and there is no evidence of token leakage or unrelated credential use.
Every API call needs `Authorization: Bearer <NEMO_TOKEN>`
Use a dedicated token for this service and avoid sharing logs or screenshots that might expose it.
Images, videos, audio, and prompts uploaded for rendering may be processed by the external provider.
The skill sends user-provided files and prompts to an external cloud provider for processing. This is central to the stated purpose, but it creates a third-party data boundary.
Base URL: `https://mega-api-prod.nemovideo.ai` ... `/api/upload-video/nemo_agent/me/<sid>` | POST | Upload a file
Do not upload sensitive, confidential, or rights-restricted media unless you trust the provider and its retention/privacy practices.
Users have less independent information for verifying who operates the skill and backend service.
The registry does not provide a source or homepage, which makes it harder to verify the publisher or service provenance before sending media to the backend.
Source: unknown; Homepage: none
Verify the provider/domain and avoid sensitive uploads if you cannot establish trust in the service.