Flow Ai Video Generator

PassAudited by ClawScan on May 13, 2026.

Overview

This skill is a coherent remote AI video generator, but users should understand that prompts, clips, and rendering sessions are sent to the NemoVideo backend using a bearer token.

This skill appears purpose-aligned for cloud AI video generation. Before using it, confirm you are comfortable sending your scripts, clips, URLs, and generated video data to the NemoVideo API, and use a dedicated or anonymous token when possible.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill will act against the video provider using a token tied to the session or environment.

Why it was flagged

The skill uses a bearer token for the NemoVideo backend and can obtain an anonymous token automatically if one is not already set.

Skill content

Check if `NEMO_TOKEN` is set in the environment... POST to `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`... The response `data.token` is your NEMO_TOKEN

Recommendation

Use a dedicated token where possible and avoid sharing token values or raw API responses.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Any prompt, clip, or URL provided for generation may be uploaded to and processed by the NemoVideo service.

Why it was flagged

The skill sends user prompts, clips, or URLs to an external backend for processing, which is expected for this purpose but involves remote data handling.

Skill content

Send me your text prompts or clips... The AI video generation runs on remote GPU nodes... **Upload**: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`

Recommendation

Only provide media and prompts you are comfortable sending to the external video-generation provider.

Low

#ASI01: Agent Goal Hijack

What this means

The remote service may influence follow-up actions inside the video-generation session, such as querying state or exporting.

Why it was flagged

The skill tells the agent to translate certain backend responses into API actions. This is disclosed and appears limited to the video workflow, but it gives backend text some control over subsequent actions.

Skill content

Backend says | You do ... "click [button]" / "点击" | Execute via API ... "Export button" / "导出" | Execute export workflow

Recommendation

Review generated results and exports, especially if using non-anonymous credentials or paid credits.