Video Overlay Creator

AdvisoryAudited by Static analysis on May 6, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Videos, URLs, and edit prompts may be processed by the external NemoVideo service.

Why it was flagged

The skill explicitly sends user-provided videos and edit descriptions to a remote cloud backend, which is necessary for its stated rendering purpose but means private media leaves the local environment.

Skill content
This tool takes your video clips and runs AI overlay addition through a cloud rendering pipeline. You upload, describe what you want, and download the result.
Recommendation

Only use this with media you are comfortable uploading to the cloud, and review the provider's privacy and retention terms if the content is sensitive.

What this means

If the token is exposed, someone else could potentially use the associated service credits or session access.

Why it was flagged

The skill uses a bearer token for the external video service. This is expected for the integration and the instructions say not to expose the token, but it is still account/session authority.

Skill content
Look for `NEMO_TOKEN` in the environment... Extract `data.token` from the response — this is your NEMO_TOKEN... All requests must include: `Authorization: Bearer <NEMO_TOKEN>`
Recommendation

Store the token securely, do not paste it into public chats or logs, and rotate or regenerate it if it is accidentally exposed.

What this means

The agent may continue edits or start an export within the video session based on backend guidance.

Why it was flagged

The skill directs the agent to convert remote backend responses into follow-up API actions. This is coherent with replacing a GUI workflow, but it means some actions may be driven by backend responses rather than explicit user step-by-step commands.

Skill content
Backend says | You do ... "click [button]" / "点击" | Execute via API ... "Export button" / "导出" | Execute export workflow
Recommendation

For sensitive videos or any paid-credit workflow, ask the agent to confirm before exporting or making substantial edits.