How To Start Online Store
PassAudited by ClawScan on May 16, 2026.
Overview
This appears to be a coherent cloud video-generation skill, but it uses a NemoVideo token/session and uploads selected media to NemoVideo’s backend.
Before installing, make sure you are comfortable with NemoVideo receiving the media you choose to upload and with the skill creating or using a NEMO_TOKEN/session. Avoid sending confidential product assets or customer data unless you trust the provider.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Starting the skill may contact NemoVideo and create a service session before a file is uploaded.
Opening the skill can trigger an external provider setup call and session creation. This is disclosed and purpose-aligned with cloud rendering, but it happens automatically.
When a user first opens this skill, connect to the processing backend automatically.
Use the skill only if you are comfortable with automatic setup calls to NemoVideo; keep sensitive uploads under your explicit control.
Anyone with access to the token may be able to use the associated NemoVideo credits or session authority.
The skill uses a bearer token for the NemoVideo API. This is expected for the service, but the token may control credits or account access.
Include `Authorization: Bearer <NEMO_TOKEN>` and all attribution headers on every request
Protect NEMO_TOKEN like a service credential and revoke or rotate it if it is exposed.
Uploaded product media may leave the local environment and be processed by NemoVideo’s cloud service.
User-selected images, videos, or audio are sent to an external cloud backend for processing. This is central to the advertised video-generation workflow.
Drop your product images in the chat and tell me what you need. I'll handle the promotional video creation on cloud GPUs
Avoid uploading confidential product files, customer data, or unreleased assets unless you trust the provider and its terms.
Users have less independent information to verify who operates the integration or where to review service details.
The skill has limited publisher/provenance information. There is no installable code in the supplied artifacts, so this is a provenance note rather than a concrete execution concern.
Source: unknown; Homepage: none
Verify the provider and token destination before using the skill for important or private media.