Chinese Subtitle

AdvisoryAudited by Static analysis on May 3, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill can authenticate to NemoVideo on the user’s behalf and create processing sessions.

Why it was flagged

The skill uses or creates a bearer token for the NemoVideo backend. This is expected for the stated service, but users should understand it grants access to backend sessions and credits.

Skill content
Check if `NEMO_TOKEN` is set in the environment... POST to `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`... The response `data.token` is your NEMO_TOKEN
Recommendation

Use a dedicated token if available, avoid sharing token values, and revoke or rotate the token if you no longer use the service.

What this means

Videos, audio, prompts, and generated outputs may be processed by NemoVideo’s cloud service.

Why it was flagged

The skill clearly sends user-provided media and prompts to an external cloud provider for processing. This is central to the skill’s purpose, but it affects privacy and data handling.

Skill content
Drop your video files in the chat... I'll handle the Chinese subtitle generation on cloud GPUs... **API base**: `https://mega-api-prod.nemovideo.ai`
Recommendation

Do not upload sensitive or confidential media unless you are comfortable with the external service processing it.

What this means

The agent may initiate setup and perform service-side actions during a subtitle-generation session without asking about every individual API call.

Why it was flagged

The agent is instructed to perform backend API actions automatically as part of the workflow. The actions appear limited to the video-rendering service, but users should know the backend can drive follow-up API steps.

Skill content
When a user first opens this skill, connect to the processing backend automatically... Backend says "click [button]" / "点击" | Execute via API
Recommendation

Monitor the session, especially uploads, credit-consuming operations, and exports; ask the agent to confirm before major actions if needed.