Generator From Photo
AdvisoryAudited by Static analysis on May 3, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Photos, prompts, and generated video state may be handled by the remote video service.
The skill sends user-selected photos or URLs to an external NemoVideo API for processing, which is central to the service but means private media leaves the local environment.
Upload: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL: `{"urls":["<url>"],"source_type":"url"}`Use this only with images and descriptions you are comfortable sending to the NemoVideo service, and avoid sensitive personal or confidential media unless you trust that provider.
Anyone with the token could potentially access the associated rendering session or credits for this service.
The skill uses a bearer token for the external rendering API. This credential use is disclosed and purpose-aligned, and the artifact instructs not to print tokens.
Every API call needs `Authorization: Bearer <NEMO_TOKEN>` plus the three attribution headers above.
Keep NEMO_TOKEN private, use a dedicated or low-privilege token where possible, and rotate it if it may have been exposed.
Using the skill may create a remote session or anonymous service token before any rendering starts.
The agent is instructed to initiate network setup automatically when the skill is used. This is normal for the cloud-render workflow, but users should recognize that first use contacts the external service.
On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".
Install only if you are comfortable with the skill contacting the NemoVideo API as part of setup.