Joy Image To Video
PassAudited by ClawScan on May 5, 2026.
Overview
This skill appears purpose-aligned for cloud image-to-video generation, but users should be comfortable with a NemoVideo token, automatic remote session setup, and uploading media to the provider.
This skill is not showing clear malicious behavior in the provided artifacts. Before installing, make sure you are comfortable sending images or videos to mega-api-prod.nemovideo.ai, using or generating a NemoVideo bearer token, and letting the skill maintain a render session while work is in progress.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Opening the skill can create an anonymous remote session with NemoVideo and begin backend setup.
The skill directs the agent to make remote API calls automatically during setup. This is aligned with the cloud-rendering purpose, but it means the skill contacts an external service before a media conversion request.
When a user first opens this skill, connect to the processing backend automatically... POST to `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`... POST to `https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent`
Install only if you are comfortable with automatic setup calls to mega-api-prod.nemovideo.ai; verify network access expectations before use.
The skill can use the configured NemoVideo token to make provider requests and consume available render credits.
The skill uses a bearer token to access the remote service, check credits, upload media, and export renders. This is expected for the integration, but the token grants account/session authority for the provider.
Every API call needs `Authorization: Bearer <NEMO_TOKEN>`... `GET /api/credits/balance/simple`... `Export` — `POST /api/render/proxy/lambda`
Use a dedicated token for this skill if possible, avoid sharing the token, and monitor or revoke it if activity looks unexpected.
Session state may link to your media drafts and rendered video jobs while the task is active.
The workflow depends on retaining a session identifier and querying session state that may reference drafts, render jobs, and uploaded media.
Store the returned `session_id` for all subsequent requests... The session token carries render job IDs... `GET /api/state/nemo_agent/me/<sid>/latest` — current draft and media info.
Avoid uploading sensitive personal media unless you trust the provider, and clear/reset sessions when finished if the platform supports it.
Users have limited independent information about who published the skill or how to verify the provider relationship.
There is no local code to execute, but the skill’s provenance and provider homepage are not available in the supplied metadata.
Source: unknown; Homepage: none; No install spec — this is an instruction-only skill.
Treat the remote service as a third-party provider and verify the NemoVideo endpoint and publisher trust before uploading important media.