Video Bootcamp
PassAudited by ClawScan on May 10, 2026.
Overview
This skill is a disclosed cloud video-editing integration that uploads user-selected media to NemoVideo and uses a provider token; no artifact-backed malicious behavior was found.
Before installing, confirm you are comfortable sending raw footage and edit instructions to mega-api-prod.nemovideo.ai, keep the NEMO_TOKEN secret, and avoid uploading sensitive or restricted videos unless the provider’s data handling is acceptable to you.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Your selected media and editing instructions will be sent to NemoVideo’s cloud service for processing.
The skill delegates uploads, editing, rendering, and polling to external API endpoints. This is central to the cloud video-editing purpose, but it is still meaningful automation over user media and render jobs.
All calls go to `https://mega-api-prod.nemovideo.ai`. The main endpoints: ... **Upload** ... **Export** ... Poll ... every 30s
Use this only with footage you are comfortable sending to the NemoVideo backend, and review exported results before posting them publicly.
The skill can act within the NemoVideo account/session represented by the token, including checking credits and starting render jobs.
The skill uses a bearer token to authenticate with the provider. This is expected for the integration and the artifact instructs not to display token values, with no evidence of credential leakage.
Every API call needs `Authorization: Bearer <NEMO_TOKEN>`
Keep NEMO_TOKEN private, use a dedicated/low-privilege token if available, and revoke or rotate it if you stop using the skill.
Private or unpublished training footage may leave your local environment and be processed on NemoVideo cloud infrastructure.
The skill sends user-provided media files or media URLs to a third-party provider. This is disclosed and purpose-aligned, but it is an important sensitive-data boundary.
**Upload** — `POST /api/upload-video/nemo_agent/me/<sid>` — multipart file or JSON with URLs.
Avoid uploading confidential, regulated, or third-party-restricted footage unless you trust the provider and its data handling terms.
It is harder to independently verify who maintains the integration or where its backend behavior is documented.
The skill is instruction-only and has no install script, but the registry metadata does not provide a source repository or homepage for provenance review.
Source: unknown; Homepage: none
Treat the provider endpoint and token flow as the trust boundary, and prefer official documentation or vendor confirmation before using sensitive media.