Text To Video Hulk

• Risk level: Low
• Analyzed: Apr 16, 2026, 8:26 PM
• Findings: 0
• Version: 1.0.0

Overview

The skill's requirements and runtime instructions are largely consistent with a cloud text→video service (it legitimately needs a NEMO_TOKEN and to call the described API endpoints), but the package lacks provenance and has a small metadata inconsistency and an external API dependency you should consider before handing over tokens or private uploads.

This skill is internally coherent for a cloud text→video service, but it calls an external API (mega-api-prod.nemovideo.ai) and requires a NEMO_TOKEN. Before installing: (1) confirm you trust the external service and its privacy/terms, because any uploaded text/files (including up to 500MB) will be sent there; avoid uploading sensitive data. (2) Prefer generating a throwaway/limited token for testing rather than reusing credentials used elsewhere. (3) Note the SKILL.md frontmatter references a local config path (~/.config/nemovideo/) while the registry metadata does not—ask the author whether the skill will read/write that directory. (4) Because the skill's source/homepage is unknown, exercise extra caution: verify the service domain, and do not expose other secrets (AWS keys, personal tokens) via NEMO_TOKEN or uploads. If you need higher assurance, request the author's homepage/source or a signed provenance record before use.