Ai Image To Video Making

• Risk level: Low
• Analyzed: Apr 16, 2026, 7:11 PM
• Findings: 0
• Version: 1.0.0

Overview

The skill's requirements and runtime instructions align with its stated purpose (calling a remote NemoVideo API to convert images to video); nothing requested appears disproportionate, though there's a small metadata inconsistency to note.

This skill appears to be what it claims: it will upload images and use a remote NemoVideo API to render videos. Before installing or running it, consider: (1) privacy — your images will be sent to https://mega-api-prod.nemovideo.ai; don't send sensitive images unless you trust that service; (2) token scope — if you set NEMO_TOKEN as an environment variable, treat it like a password (it authorizes API actions); prefer using an anonymous token or a limited-scope token if available; (3) metadata mismatch — SKILL.md mentions a config path (~/.config/nemovideo/) even though registry metadata didn't list it; verify whether the agent will read that directory if you care about local config exposure; (4) network monitoring — the skill relies entirely on HTTP calls, so review logs or network policies if you need to restrict outbound access. If any of these are unacceptable, do not install or provide a persistent NEMO_TOKEN.