Video Maker Japanese

ReviewAudited by ClawScan on Apr 30, 2026.

Overview

This instruction-only video-making skill appears purpose-aligned, but it uses a NemoVideo cloud backend, token-based sessions, and uploads user media to that service.

This skill is suitable if you want a cloud service to create Japanese-language videos from your clips or images. Before installing, be comfortable with uploading media to NemoVideo, using a NEMO_TOKEN or anonymous starter token, and having remote session/render state stored while the video is generated.

Findings (8)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The backend service may guide the assistant to perform editing or export steps after a user request.

Why it was flagged

The skill tells the agent to treat backend response text as instructions for further API actions. This is purpose-aligned for translating a GUI-oriented backend into API calls, but it means remote responses can steer the agent's next actions within the workflow.

Skill content
"Backend says" ... "click [button]" / "点击" | "Execute via API"
Recommendation

Use the skill only when you are comfortable letting the NemoVideo backend drive video-editing workflow steps; review outputs before relying on them.

What this means

Files, images, audio, or URLs provided for editing may be uploaded to NemoVideo's cloud service.

Why it was flagged

The skill exposes upload and URL-ingestion operations to a remote service. This is expected for cloud video generation, but users should notice that selected files or URLs are sent to the backend.

Skill content
"Upload": POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL: `{"urls":["<url>"],"source_type":"url"}`
Recommendation

Only provide media you are allowed and willing to upload to the external video service.

What this means

The skill can act against the NemoVideo service using the configured token or an acquired starter token.

Why it was flagged

The skill uses a bearer token to access the NemoVideo API. This credential is declared as the primary credential in the provided requirements, so it is purpose-aligned, but it grants service access for session, upload, state, credits, and render operations.

Skill content
Include `Authorization: Bearer <NEMO_TOKEN>` ... on every request
Recommendation

Use a token intended for this service and avoid sharing broader account credentials.

What this means

It may be harder to verify who operates or maintains the integration before trusting it with media uploads.

Why it was flagged

The skill has no code dependencies or install script, but its publisher/source provenance is limited and no homepage is provided for independent verification of the backend service.

Skill content
Source: unknown; Homepage: none
Recommendation

Review the owner and service endpoint before using it for private or business-sensitive videos.

What this means

Video draft state is maintained by the remote service and reused during the workflow.

Why it was flagged

The skill relies on remote session state, draft timelines, and generated media metadata. This is normal for a video editor, but it means previous session context can influence later export and status actions.

Skill content
"Session state": GET `/api/state/nemo_agent/me/<sid>/latest` — key fields: `data.state.draft`, `data.state.video_infos`, `data.state.generated_media`
Recommendation

Start a fresh session for unrelated projects and avoid mixing sensitive and non-sensitive media in the same session.

What this means

Your prompts and media-processing context may be handled by the remote NemoVideo agent backend.

Why it was flagged

The skill communicates with a remote `nemo_agent` over the NemoVideo API and sends user prompts, session identifiers, and uploaded media workflow data. Authorization and session IDs are specified, but data still crosses a third-party agent/service boundary.

Skill content
"Send message (SSE)": POST `/run_sse` — body `{"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}}`
Recommendation

Do not send confidential footage, unreleased marketing material, or personal data unless you trust the service and its data handling.

What this means

The chat may not show all backend connection details even though remote service calls are being made.

Why it was flagged

The skill asks the assistant to hide connection and token/session details from normal chat. This can be acceptable UX simplification, but users should still understand that a third-party cloud backend is being used.

Skill content
Tell the user you're ready. Keep the technical details out of the chat.
Recommendation

Review the skill description and endpoint details before use, especially for sensitive media.

What this means

A render may keep running on the cloud service even if you close the tab before completion.

Why it was flagged

Render jobs can continue remotely after the local interaction is interrupted. This is expected for cloud rendering, but it is a form of background service activity tied to the session.

Skill content
The session token carries render job IDs, so closing the tab before completion orphans the job.
Recommendation

Wait for jobs to finish or check status before closing the session when working with sensitive or time-critical projects.