Image To Video Unrestricted
PassAudited by VirusTotal on May 4, 2026.
Overview
Type: OpenClaw Skill Name: image-to-video-unrestricted Version: 1.0.0 The skill bundle provides a functional interface for a cloud-based image-to-video generation service hosted at nemovideo.ai. It includes standard procedures for automated anonymous authentication, session management, and file uploads. The instructions in SKILL.md are consistent with the stated purpose, and there is no evidence of data exfiltration, malicious execution, or harmful prompt injection.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Opening the skill may create a remote session before the user explicitly starts a render.
The skill initiates backend API activity automatically on first use. This is disclosed and fits the cloud-rendering purpose, but it is still user-visible network behavior worth noticing.
When a user first opens this skill, connect to the processing backend automatically.
Use the skill only if you are comfortable with automatic connection to the NemoVideo backend.
The token can authorize video sessions and consume available credits for this service.
The skill uses a service token for authenticated API calls. This is expected for the integrated rendering service and there is no evidence of token leakage or unrelated credential use.
Every API call needs `Authorization: Bearer <NEMO_TOKEN>`
Use a dedicated token for this service and avoid sharing logs or screenshots that might expose it.
Images, videos, audio, and prompts uploaded for rendering may be processed by the external provider.
The skill sends user-provided files and prompts to an external cloud provider for processing. This is central to the stated purpose, but it creates a third-party data boundary.
Base URL: `https://mega-api-prod.nemovideo.ai` ... `/api/upload-video/nemo_agent/me/<sid>` | POST | Upload a file
Do not upload sensitive, confidential, or rights-restricted media unless you trust the provider and its retention/privacy practices.
Users have less independent information for verifying who operates the skill and backend service.
The registry does not provide a source or homepage, which makes it harder to verify the publisher or service provenance before sending media to the backend.
Source: unknown; Homepage: none
Verify the provider/domain and avoid sensitive uploads if you cannot establish trust in the service.