Ai Avatar Video Generator
ReviewAudited by ClawScan on May 10, 2026.
Overview
Prompt-injection indicators were detected in the submitted artifacts (unicode-control-chars); human review is required before treating this skill as clean.
This skill appears benign and purpose-aligned for cloud avatar video generation. Before installing, verify that you trust the NemoVideo API domain, use a dedicated token if possible, and avoid uploading sensitive scripts, audio, or media unless you are comfortable with that provider processing it. ClawScan detected prompt-injection indicators (unicode-control-chars), so this skill requires review even though the model response was benign.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
You have less information for confirming that this skill is the legitimate integration for the NemoVideo API.
The skill is instruction-only and has no install script, but users cannot verify publisher provenance or service documentation from the provided registry data.
Source: unknown; Homepage: none
Verify the provider/domain and token expectations before using it with valuable account credentials or sensitive media.
The agent can use the configured or anonymous NemoVideo token to create sessions, check credits, upload inputs, and run render/export workflows.
The skill uses a bearer token for the external video service, which is expected for API access but still grants delegated service authority.
If `NEMO_TOKEN` is in the environment, use it directly... Otherwise, acquire a free starter token... All requests must include: `Authorization: Bearer <NEMO_TOKEN>`
Use a dedicated token, avoid sharing broader credentials, and monitor/revoke the token if you stop using the skill.
Scripts, audio, video, or other selected files may leave your environment and be processed by NemoVideo's cloud service.
User-selected scripts or media are uploaded to an external backend agent/service for processing, which is central to the skill's purpose but important for privacy.
API base: `https://mega-api-prod.nemovideo.ai` ... Upload: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`
Only upload content you are comfortable sending to that provider, and avoid confidential, regulated, or third-party-sensitive material unless you trust the service terms.
The service workflow may cause the agent to perform upload, state, edit, render, or export calls as part of fulfilling a video request.
The skill tells the agent to translate backend workflow messages into API actions; this is purpose-aligned, but users should know the backend can drive steps inside the video-generation session.
The backend responds as if there's a visual interface. Map its instructions to API calls: ... `Export` or `导出` → run the export workflow
For sensitive or costly projects, ask the agent to summarize planned actions and confirm before uploading files or starting exports.