Ai Caption Generator Free

PassAudited by ClawScan on Apr 30, 2026.

Overview

This is a cloud video-captioning skill that uses a NemoVideo token and API to upload and render videos, which fits its purpose, but users should know their media and prompts go to that external service.

Use this skill if you are comfortable sending your videos, media URLs, and editing prompts to the external NemoVideo API for cloud captioning and rendering. Avoid uploading confidential footage unless that matches your privacy expectations, and keep any NEMO_TOKEN private.

Findings (9)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence
ASI01: Agent Goal Hijack
What this means

The external service's responses may cause the assistant to perform state queries, edits, or exports within the video-captioning workflow.

Why it was flagged

Backend GUI-like instructions are translated into API actions, so service responses can influence follow-up workflow steps. This is purpose-aligned for the captioning/editing backend.

Skill content
"click" or "点击" → execute the action via the relevant endpoint ... "Export" or "导出" → run the export workflow
Recommendation

Use the skill for videos you intend to process, and ask the assistant to confirm important steps such as upload or export if you want extra control.

What this means

Videos or media URLs you provide can be sent to the NemoVideo backend and rendered in the cloud.

Why it was flagged

The skill uses API operations to upload user media and create cloud render jobs. These actions are central to caption generation and are not shown as destructive or unrelated.

Skill content
**Upload**: POST `/api/upload-video/nemo_agent/me/<sid>` ... **Export**: POST `/api/render/proxy/lambda`
Recommendation

Only provide files or URLs you want processed by the external captioning service.

What this means

The skill can authenticate to NemoVideo on your behalf for sessions, uploads, credits, state checks, and exports.

Why it was flagged

The skill uses a bearer token for the NemoVideo backend, or obtains an anonymous starter token if none is present. This credential use is expected for the service integration.

Skill content
If `NEMO_TOKEN` is in the environment, use it directly ... Otherwise, acquire a free starter token ... use it as NEMO_TOKEN
Recommendation

Treat NEMO_TOKEN like a service credential and avoid sharing it outside the intended NemoVideo workflow.

What this means

You have less public source or homepage context for the skill publisher and backend relationship.

Why it was flagged

The registry metadata provides limited provenance information. Because the artifact has no install script or code files, this is a provenance note rather than evidence of a malicious supply chain.

Skill content
Source: unknown; Homepage: none
Recommendation

Review the provider identity and only use the skill if you are comfortable with the NemoVideo API endpoint named in the instructions.

What this means

Project state and generated media metadata may persist in the remote session while the workflow is active.

Why it was flagged

The skill relies on remote session state containing drafts, video information, and generated media. This is expected for a video editing session but means prior session context can affect later steps.

Skill content
**Session state**: GET `/api/state/nemo_agent/me/<sid>/latest` — key fields: `data.state.draft`, `data.state.video_infos`, `data.state.generated_media`
Recommendation

Start a fresh session for unrelated projects and avoid mixing sensitive and non-sensitive video tasks in the same session.

What this means

Your prompts and workflow messages can be sent to the NemoVideo backend agent for processing.

Why it was flagged

The assistant communicates with an external backend agent/service over SSE using a session ID and bearer authorization. This is disclosed and purpose-aligned, but it is still an external data boundary.

Skill content
**Send message (SSE)**: POST `/run_sse` — body `{"app_name":"nemo_agent","user_id":"me","session_id":"<sid>"...}` with `Accept: text/event-stream`
Recommendation

Do not include confidential information in prompts or uploaded media unless you are comfortable sending it to that external service.

NoteHigh Confidence
ASI08: Cascading Failures
What this means

A render may continue in the cloud even if you stop watching the session before it completes.

Why it was flagged

A cloud render job can continue or become untracked if the client is closed before completion. This is a disclosed operational limitation, not evidence of broader propagation.

Skill content
The session token carries render job IDs, so closing the tab before completion orphans the job.
Recommendation

Wait for renders to complete when possible and avoid starting exports you do not want processed.

What this means

A user may not see the API/session/token mechanics unless they review the skill instructions.

Why it was flagged

The skill instructs the assistant to simplify or omit backend/token details in chat. Since the same file also discloses cloud processing, this is a transparency note rather than a deception concern.

Skill content
Tell the user you're ready. Keep the technical details out of the chat.
Recommendation

Before uploading sensitive media, confirm that you are comfortable with external cloud processing by NemoVideo.

NoteHigh Confidence
ASI10: Rogue Agents
What this means

A started export may keep processing remotely until the backend finishes or times out.

Why it was flagged

The artifact shows background cloud render jobs can continue after a client closes. This is expected for rendering and is disclosed; there is no evidence of self-propagation or hidden autonomous behavior.

Skill content
Each export job queues on a cloud GPU node ... closing the tab before completion orphans the job.
Recommendation

Start exports only when you intend the remote service to process the media, and monitor completion for sensitive projects.