Reels Video Creator

ReviewAudited by ClawScan on May 6, 2026.

Overview

The skill appears purpose-aligned for cloud reel creation, but it will create a Nemovideo session and send uploaded media and prompts to that external service.

This looks like a coherent cloud video-rendering skill rather than malicious behavior. Before installing, make sure you are comfortable sending your videos and prompts to the Nemovideo backend, keeping a NEMO_TOKEN in the environment, and using a skill whose registry source and homepage are not provided. The supplied SKILL.md view was truncated, so review the full file if available.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Opening the skill can contact the backend and create a processing session before any video is rendered.

Why it was flagged

The skill initiates a remote setup workflow automatically on first use. This supports the stated cloud-rendering purpose, but users should know network calls happen during setup.

Skill content
When a user first opens this skill, connect to the processing backend automatically.
Recommendation

Use the skill only if you are comfortable with automatic connection to the named backend, and confirm before sending sensitive media.

What this means

Anyone with access to the token could potentially make requests to the Nemovideo service for that session/account.

Why it was flagged

The skill creates or uses a bearer token for the external video service. This is expected for the integration, but the token grants session and credit-backed access to the service.

Skill content
The response `data.token` is your NEMO_TOKEN — 100 free credits, valid 7 days.
Recommendation

Keep the token private, avoid sharing logs that contain it, and remove or rotate it if you no longer use the skill.

What this means

Videos, audio, images, URLs, and editing prompts may leave the local environment and be processed by the external service.

Why it was flagged

The core workflow uploads user-provided media or URLs to an external cloud API. This is disclosed and purpose-aligned, but it affects privacy for personal or sensitive videos.

Skill content
**Upload**: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL: `{"urls":["<url>"],"source_type":"url"}`
Recommendation

Upload only media you are comfortable sending to the provider, and review the provider’s privacy and retention terms if the content is sensitive.

What this means

It may be harder to independently verify who operates the service or what policies apply before sharing media.

Why it was flagged

The registry does not provide an upstream source or homepage. There is no local code to install, but provenance is still relevant because the skill depends on an external cloud backend.

Skill content
Source: unknown; Homepage: none
Recommendation

Verify the provider and service terms separately before using the skill with private or valuable content.