Generator Video Maker

PassAudited by ClawScan on May 4, 2026.

Overview

This appears to be a disclosed cloud video-generation connector, but it sends prompts/files to NemoVideo and uses a service token.

This skill is reasonable for cloud-based video generation. Before installing, make sure you are comfortable sending prompts and media to NemoVideo, use a dedicated token if possible, and avoid uploading confidential or regulated content.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Invoking the skill can create sessions, submit prompts or media, and start export workflows through the NemoVideo API without a separate approval for each API call.

Why it was flagged

The skill instructs the agent to make automatic API calls for setup, generation, upload, and export. This is central to the video-generation purpose, but it means use of the skill triggers remote service actions.

Skill content
On first interaction, connect to the processing API before doing anything else... Send message (SSE): POST `/run_sse`... **Upload**: POST `/api/upload-video/nemo_agent/me/<sid>`... **Export** ... Poll GET
Recommendation

Use it when you intend cloud video processing, and monitor any jobs or credits associated with your NemoVideo token.

What this means

A NemoVideo token could allow video jobs or account/service actions under that credential if mishandled.

Why it was flagged

The skill uses a bearer token for the NemoVideo service. This is expected for authentication and the instructions include a token-handling precaution, but the token still grants service authority.

Skill content
If `NEMO_TOKEN` environment variable is already set, use it... Every API call needs `Authorization: Bearer <NEMO_TOKEN>`... Don't print tokens or raw JSON.
Recommendation

Use a service-specific token, avoid sharing it in chats or logs, and revoke or rotate it if you no longer trust the skill or service.

What this means

Prompts, clips, images, audio, and generated project state may be processed by the external NemoVideo service.

Why it was flagged

The skill can transmit user-provided media files to a remote API for processing. This is expected for cloud video generation, but private or proprietary media may leave the user's environment.

Skill content
Upload MP4, MOV, PNG, JPG files up to 500MB... **Upload**: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`
Recommendation

Do not upload confidential, regulated, or proprietary media unless you are comfortable with the NemoVideo service handling it.

What this means

It is harder to independently verify who operates the integration or review service terms before sending content.

Why it was flagged

The registry metadata does not provide a source repository or homepage. There is no local code to install, but users have limited information for verifying the publisher or service.

Skill content
Source: unknown
Homepage: none
Recommendation

Review the full registry listing and NemoVideo service trust/privacy information before using it with sensitive content.