Image To Video Capcut
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user expecting CapCut may upload private photos, videos, or audio to a different provider.
The skill is branded around CapCut, but the documented service endpoint is NemoVideo. Without an explicit unofficial/powered-by disclosure, users may misunderstand who receives their media.
displayName: "Image to Video CapCut — Convert Photos Into Shareable Videos" ... Base URL: `https://mega-api-prod.nemovideo.ai`
Clarify prominently that this is not an official CapCut integration, identify NemoVideo as the backend provider, and ask users to confirm before uploads.
Uploaded images, videos, audio, prompts, and generated project state may be processed and retained by the remote service.
The skill sends user-selected media to a remote provider for processing. This is necessary for the stated cloud workflow, but becomes a concern because the user-facing provider branding is ambiguous.
`/api/upload-video/nemo_agent/me/<sid>` | POST | Upload a file (multipart) or URL. ... All rendering happens server-side.
Only upload media you are comfortable sending to NemoVideo, and avoid sensitive personal or confidential files unless the provider terms are acceptable.
Anyone with the token could potentially use the associated session or credits until it expires or is revoked.
The skill uses a bearer token to authorize sessions, credits, uploads, and exports. This is purpose-aligned for the NemoVideo service, but the token should be treated as a credential.
Include `Authorization: Bearer <NEMO_TOKEN>` ... Obtain a free token ... response `data.token` is your NEMO_TOKEN — 100 free credits, valid 7 days.
Keep NEMO_TOKEN private, avoid logging it, and remove or rotate it if you stop using the skill.
Opening the skill may create an anonymous backend token/session before a video is generated.
The skill initiates backend setup automatically on first open. The behavior is disclosed and limited to service setup, but it is still external network activity.
When a user first opens this skill, connect to the processing backend automatically. Briefly let them know (e.g. "Setting up...").
Use the skill only if you are comfortable with automatic setup calls to the documented backend; the skill should ideally make the provider clear before connecting.
It is harder to confirm whether the skill is affiliated with CapCut, NemoVideo, or another operator.
The registry metadata does not provide a source repository or homepage to verify authorship, provider affiliation, or maintenance history. No local code is installed, so this is a provenance note rather than direct execution risk.
Source: unknown; Homepage: none
Verify the provider and terms independently before sending private media or relying on the service.