Text To Video Json Prompt

• Risk level: Low
• Analyzed: Apr 12, 2026, 10:06 PM
• Findings: 0
• Version: 1.0.0

Overview

The skill's requirements and runtime instructions are internally consistent with a text→video service: it asks for a single service token, describes API calls for session, upload, and render, and has no install steps or unrelated permissions — but the service domain is unknown and uploads are sent to an external server, so review before sending sensitive data.

This skill appears to do what it says: it talks to a third-party rendering API and uploads files for server-side video creation. Before installing/using it, consider: (1) the NEMO_TOKEN is a bearer secret — do not supply a token you use elsewhere; prefer the anonymous-token flow if you don't trust the service, (2) anything you upload (videos, images, JSON) will go to mega-api-prod.nemovideo.ai — check the service's privacy/retention policy or avoid uploading sensitive content, (3) the skill may probe a couple of standard install paths to set an attribution header — if you are uncomfortable with filesystem probing, decline or ask for a version that doesn't do that, and (4) because the skill's source and homepage are unknown, you may want to test with throwaway data/tokens first. If you can obtain documentation or a known, trusted homepage for the nemovideo service, that would raise confidence; conversely, if the API domain or anonymous-token endpoint is untrusted or the skill asked for unrelated credentials, reassess and treat as suspicious.