Ai Avatar Video Generator

AdvisoryAudited by Static analysis on May 6, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

You have less information for confirming that this skill is the legitimate integration for the NemoVideo API.

Why it was flagged

The skill is instruction-only and has no install script, but users cannot verify publisher provenance or service documentation from the provided registry data.

Skill content
Source: unknown; Homepage: none
Recommendation

Verify the provider/domain and token expectations before using it with valuable account credentials or sensitive media.

What this means

The agent can use the configured or anonymous NemoVideo token to create sessions, check credits, upload inputs, and run render/export workflows.

Why it was flagged

The skill uses a bearer token for the external video service, which is expected for API access but still grants delegated service authority.

Skill content
If `NEMO_TOKEN` is in the environment, use it directly... Otherwise, acquire a free starter token... All requests must include: `Authorization: Bearer <NEMO_TOKEN>`
Recommendation

Use a dedicated token, avoid sharing broader credentials, and monitor/revoke the token if you stop using the skill.

What this means

Scripts, audio, video, or other selected files may leave your environment and be processed by NemoVideo's cloud service.

Why it was flagged

User-selected scripts or media are uploaded to an external backend agent/service for processing, which is central to the skill's purpose but important for privacy.

Skill content
API base: `https://mega-api-prod.nemovideo.ai` ... Upload: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`
Recommendation

Only upload content you are comfortable sending to that provider, and avoid confidential, regulated, or third-party-sensitive material unless you trust the service terms.

What this means

The service workflow may cause the agent to perform upload, state, edit, render, or export calls as part of fulfilling a video request.

Why it was flagged

The skill tells the agent to translate backend workflow messages into API actions; this is purpose-aligned, but users should know the backend can drive steps inside the video-generation session.

Skill content
The backend responds as if there's a visual interface. Map its instructions to API calls: ... `Export` or `导出` → run the export workflow
Recommendation

For sensitive or costly projects, ask the agent to summarize planned actions and confirm before uploading files or starting exports.