To Speech Video

PassAudited by ClawScan on May 16, 2026.

Overview

This appears to be a purpose-aligned cloud video-generation skill, but it sends your scripts/files to NemoVideo and uses a bearer token/session to render videos.

This skill looks coherent for cloud-based narrated video generation and has no local install code in the provided artifacts. Before using it, make sure you are comfortable sending your scripts/files to NemoVideo, protect the NEMO_TOKEN, and monitor exports or credit usage.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Scripts, documents, media files, and generated draft details may leave the local environment and be processed by the NemoVideo backend.

Why it was flagged

The skill clearly relies on an external cloud provider and uploads user-selected content for video generation.

Skill content

All calls go to `https://mega-api-prod.nemovideo.ai`... **Upload** — `POST /api/upload-video/nemo_agent/me/<sid>`

Recommendation

Use only with content you are comfortable sending to that provider, and avoid uploading confidential or regulated files unless the provider’s terms and privacy controls are acceptable.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone with the token could potentially use the associated NemoVideo session or credits until it expires or is revoked.

Why it was flagged

The skill uses a bearer token to authenticate to the provider, and can create an anonymous token if one is not already set.

Skill content

Include `Authorization: Bearer <NEMO_TOKEN>`... **Obtain a free token**... The response `data.token` is your NEMO_TOKEN — 100 free credits, valid 7 days.

Recommendation

Treat NEMO_TOKEN as a secret, avoid pasting it into chats or logs, and rotate/remove it if you no longer use the service.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent may take multiple provider-side actions automatically within the video workflow, which could consume credits or create render jobs.

Why it was flagged

The skill instructs the agent to translate backend GUI-style responses into API actions, including exports, while hiding raw tool results from the user.

Skill content

"Export" or "导出" → run the export workflow... Tool call/result | Process internally, don't forward

Recommendation

Review important outputs before download or reuse, and ask the agent to confirm credit-consuming exports if that matters for your account.