Image To Generator

PassAudited by ClawScan on May 13, 2026.

Overview

The skill is coherent for turning user-provided images into videos via a disclosed cloud API, but users should know their media and a NemoVideo token are sent to that service.

This appears to be an instruction-only cloud video generator rather than local code. Before installing, be comfortable with sending selected media to mega-api-prod.nemovideo.ai, using or creating a NEMO_TOKEN, and possibly consuming service credits during rendering/export.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent will authenticate to a third-party service on your behalf, using either your existing token or an automatically acquired anonymous token.

Why it was flagged

The skill automatically obtains or uses a bearer token for the NemoVideo service and attaches it to API requests.

Skill content
Look for `NEMO_TOKEN` in the environment... Extract `data.token` from the response — this is your NEMO_TOKEN... Include `Authorization: Bearer <NEMO_TOKEN>`
Recommendation

Only use this skill if you are comfortable with NemoVideo authentication being handled by the agent; avoid sharing the token and monitor credit usage.

What this means

Images, audio, URLs, prompts, and generated project state may be sent to NemoVideo's cloud service to produce the video.

Why it was flagged

The skill sends user media and task data to a disclosed external provider API for cloud processing.

Skill content
All calls go to `https://mega-api-prod.nemovideo.ai`... **Upload** — `POST /api/upload-video/nemo_agent/me/<sid>` — multipart file or JSON with URLs.
Recommendation

Upload only media you are allowed to share with this provider, and avoid sending confidential images unless the provider's privacy terms meet your needs.

What this means

The agent may carry out a sequence of cloud-side actions inside the video project based on the user's request and service responses.

Why it was flagged

The skill tells the agent to convert backend GUI-style instructions into API operations such as edits, state queries, and exports.

Skill content
"click" or "点击" → execute the action via the relevant endpoint... "Export" or "导出" → run the export workflow
Recommendation

Review the requested edit/export intent before proceeding, especially if exports consume credits or publish/download final media.

What this means

Users have less provenance information for deciding whether the external API integration is from a trusted publisher.

Why it was flagged

The registry metadata does not provide a source repository or homepage for independently verifying the skill or service relationship.

Skill content
Source: unknown; Homepage: none
Recommendation

Prefer installing only if you trust the listed publisher and the NemoVideo API endpoint; verify the provider separately if handling sensitive media.