Pika Labs

• Risk level: Low
• Analyzed: Mar 31, 2026, 1:44 PM
• Findings: 0
• Version: 1.0.0

Overview

The skill's requests and runtime instructions are consistent with a video-generation integration: it asks for a single service token, documents API endpoints, and only writes a small client config; nothing indicates it is trying to do unrelated or hidden actions.

This skill is internally consistent, but review these practical points before installing: (1) It will send any provided images/text to nemovideo's API — don’t upload sensitive content unless you trust the service and its privacy terms. (2) If you don't supply NEMO_TOKEN the skill can request an anonymous token and will create ~/.config/nemovideo/client_id; that file is harmless but note where data is stored. (3) The skill generates a claim URL that embeds the token as a URL parameter — avoid sharing that link publicly because it may expose your token/session. (4) Verify the API domain (mega-api-prod.nemovideo.ai) and the service's trustworthiness before providing a long-lived NEMO_TOKEN; consider using a limited-scope or throwaway token if possible. (5) Because this is instruction-only (no install scripts), nothing else will be written to disk beyond the declared config path.