Motivation Video
AdvisoryAudited by Static analysis on May 5, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Personal or confidential videos shared with the skill may be uploaded to NemoVideo's servers for processing.
The skill explicitly relies on a third-party cloud service for rendering, so user clips and prompts may leave the local environment.
This skill connects to a cloud processing backend... All rendering happens server-side.
Use only content you are comfortable sending to a third-party cloud service, and review the provider's privacy/retention terms if the clips are sensitive.
The token can authorize requests to the video service and may be tied to credits or account activity.
The skill uses a bearer token, and can create an anonymous service token if one is not already present.
Look for `NEMO_TOKEN` in the environment... POST `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`... Every API call needs `Authorization: Bearer <NEMO_TOKEN>`
Keep NEMO_TOKEN private, avoid pasting it into chats or logs, and rotate or remove it if it may have been exposed.
Using the skill may immediately contact the external service and create a session/token as part of normal operation.
The agent is instructed to automatically initialize the remote API session after the skill is used, rather than requiring a separate manual setup step.
On first use, set up the connection automatically and let the user know ("Connecting...").If you need strict control over network activity, invoke the skill only when you are ready to connect to NemoVideo.
Users have less public context for verifying who maintains the skill or the referenced backend integration.
The registry metadata does not provide a source repository or homepage for independent provenance review.
Source: unknown; Homepage: none
Prefer testing with non-sensitive media first and verify the provider out-of-band before relying on it for private or business content.