Free No Generator
PassAudited by ClawScan on May 12, 2026.
Overview
The skill is a cloud video-editing connector that clearly uses a NemoVideo token and uploads user-provided media for processing, but users should understand their videos leave the device.
This looks like a coherent cloud video-editing skill rather than a malicious one. Before installing, make sure you are comfortable sending selected video files and edit prompts to the NemoVideo backend, and use a dedicated NEMO_TOKEN if possible.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may create or use a NemoVideo session under a token, so backend actions are tied to that credential.
The skill uses a bearer token for an external service. This is expected for the video-editing backend and the artifact does not show token logging or unrelated credential use.
Look for `NEMO_TOKEN` in the environment... POST `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`... Every API call needs `Authorization: Bearer <NEMO_TOKEN>`
Use a token intended for this service only, and avoid sharing the token or raw API responses.
Videos provided to the skill may be sent to NemoVideo’s cloud service for editing and rendering.
User-selected video files are uploaded to a remote cloud backend for processing. This is central to the skill’s stated purpose and is disclosed.
This skill connects to a cloud processing backend... **Upload**: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`
Only upload media you are comfortable processing through that external service, especially if it contains private people, locations, or business content.
The remote backend may interpret and execute editing instructions for the active video session.
Most edit instructions are sent to the backend agent via SSE. This appears purpose-aligned, but it means broad natural-language editing requests are delegated to the remote service.
Everything else (generate, edit, add BGM…) | → §3.1 SSE | ❌
Review the generated result before using or publishing it, and give specific edit instructions to reduce unintended output.