Generator From Photo

PassAudited by ClawScan on May 3, 2026.

Overview

This skill is a coherent remote photo-to-video generator, but users should know it sends uploaded media and prompts to the NemoVideo API and uses a bearer token.

This looks appropriate for a cloud photo-to-video skill. Before installing, make sure you are comfortable sending your images and prompts to the NemoVideo API, keep the NEMO_TOKEN secret, and avoid uploading private or confidential media unless you trust the provider's handling of it.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Photos, prompts, and generated video state may be handled by the remote video service.

Why it was flagged

The skill sends user-selected photos or URLs to an external NemoVideo API for processing, which is central to the service but means private media leaves the local environment.

Skill content

Upload: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL: `{"urls":["<url>"],"source_type":"url"}`

Recommendation

Use this only with images and descriptions you are comfortable sending to the NemoVideo service, and avoid sensitive personal or confidential media unless you trust that provider.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone with the token could potentially access the associated rendering session or credits for this service.

Why it was flagged

The skill uses a bearer token for the external rendering API. This credential use is disclosed and purpose-aligned, and the artifact instructs not to print tokens.

Skill content

Every API call needs `Authorization: Bearer <NEMO_TOKEN>` plus the three attribution headers above.

Recommendation

Keep NEMO_TOKEN private, use a dedicated or low-privilege token where possible, and rotate it if it may have been exposed.

Note

ASI02: Tool Misuse and Exploitation

What this means

Using the skill may create a remote session or anonymous service token before any rendering starts.

Why it was flagged

The agent is instructed to initiate network setup automatically when the skill is used. This is normal for the cloud-render workflow, but users should recognize that first use contacts the external service.

Skill content

On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".

Recommendation

Install only if you are comfortable with the skill contacting the NemoVideo API as part of setup.