Create A Video

ReviewAudited by ClawScan on Apr 30, 2026.

Overview

This instruction-only video skill is broadly aligned with its purpose, but it sends user media and prompts to a remote NemoVideo cloud agent/API and uses a bearer token or auto-created anonymous token.

Install only if you are comfortable sending your media and prompts to the NemoVideo cloud service. Use non-sensitive assets, verify the provider/domain, monitor credits or plan limits, and start fresh sessions for unrelated projects.

Findings (8)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The cloud service can influence intermediate video-editing actions without every step being separately shown to the user.

Why it was flagged

Remote backend text is treated as instructions for API actions. This is purpose-aligned for translating a GUI video service into API calls, but it means external service responses can steer agent behavior inside the workflow.

Skill content
Backend says: "click [button]" / "点击" | You do: "Execute via API"
Recommendation

Use the skill for intended video tasks only and review final state, exports, and downloads before relying on the result.

What this means

Files you provide may be transferred to the remote video service for processing.

Why it was flagged

The skill instructs the agent to upload user-provided local files or URLs to the cloud backend. This is expected for video creation, but it is still a high-impact file-transfer operation.

Skill content
Upload: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL: `{"urls":["<url>"],"source_type":"url"}`
Recommendation

Only provide files and URLs you intend to upload to the NemoVideo backend.

What this means

The skill may create or use a NemoVideo service identity and consume free or account-linked credits.

Why it was flagged

The skill uses a bearer token and can automatically obtain an anonymous token for the service. The credential is declared and purpose-aligned, but it still grants access to credits/session operations.

Skill content
If found, skip to session creation. Otherwise: Generate a UUID as client identifier; POST `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`; Extract `data.token` ...
Recommendation

Use a dedicated token where possible and monitor credit usage or account state if you connect a registered account.

What this means

Users have limited registry-provided provenance information for the service behind the skill.

Why it was flagged

There is no local package or code dependency, but the registry does not provide source or homepage provenance for a skill that relies on a remote cloud service.

Skill content
Source: unknown; Homepage: none
Recommendation

Confirm the provider and domain are expected before sending important media or account-linked tokens.

What this means

Previously generated or uploaded session content can influence the current video project.

Why it was flagged

The skill relies on cloud session state and draft data for later actions such as export. This is normal for video editing, but stale or incorrect session state could affect subsequent outputs within the session.

Skill content
Session state: GET `/api/state/nemo_agent/me/<sid>/latest` — key fields: `data.state.draft`, `data.state.video_infos`, `data.state.generated_media`
Recommendation

Start a new session for unrelated projects or when you do not want prior draft state to carry over.

What this means

Your media instructions and project state may be processed by a remote agent/service, not just the local assistant.

Why it was flagged

The skill communicates with a remote agent-like backend over SSE and API calls. This is central to the skill's design, but user prompts, media references, and workflow state cross a provider boundary.

Skill content
Create session: POST `/api/tasks/me/with-session/nemo_agent` ... Send message (SSE): POST `/run_sse` ... `app_name":"nemo_agent"`
Recommendation

Avoid sending sensitive, confidential, or regulated media unless you trust the NemoVideo service and its handling of uploaded content.

What this means

Users could be surprised by credit, free-plan, or subscription limitations during export.

Why it was flagged

The skill describes export as free/no-credit, while also documenting subscription-tier blocking. This is not necessarily deceptive, but the cost and plan behavior may not be obvious to users.

Skill content
`Export` (free, no credits) ... `402` — free plan export blocked; not a credit issue, subscription tier
Recommendation

Check the credit balance and plan behavior before relying on the service for time-sensitive exports.

What this means

A render job may continue in the cloud after you stop watching the session.

Why it was flagged

Cloud render jobs may continue or become orphaned if the user leaves before completion. This is consistent with asynchronous rendering, but it is a form of backend activity that can outlive the active interaction.

Skill content
The session token carries render job IDs, so closing the tab before completion orphans the job.
Recommendation

Wait for completion when possible and avoid starting renders you do not intend to finish.